IPv6 full response prefix detection method and device in Internet range and storage medium

Abstract

The invention relates to the technical field of internet IPv6 network measurement, in particular to an IPv6 full response prefix detection method, device and equipment in an internet range and a computer storage medium. According to the method, knowledge (namely an address mode) useful for detecting active prefixes under target prefixes is mined and utilized from existing seed prefixes, so that the efficiency of target prefix detection is improved, and then a seed prefix library is enriched by detecting new prefixes; according to the invention, active IPv6 full-response prefix detection can be carried out on any routing prefix, and a high hit rate is always kept.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet IPv6 network measurement, and in particular to an Internet-wide IPv6 full-response prefix detection method, device, equipment and computer storage medium. Background Art

[0002] As IPv4 address resources are exhausted, IPv6, as the core of the next generation Internet, is rapidly developing and widely deployed in the world. By October 2024, nearly 45% of Google users will obtain services through IPv6, while this figure was less than 2% 10 years ago. Therefore, IPv6-related network measurement work in the global Internet will become increasingly important. In recent years, related IPv6 network measurement research is constantly being proposed, such as IPv6 active address detection, port detection, topology discovery, etc.

[0003] However, a special type of prefix in IPv6 has a huge impact on IPv6 network measurement, namely the fully responsive prefix. A fully responsive prefix is ​​defined as a prefix in which all addresses under the prefix respond to probes (such as ICMPv6 Echo Request). For example, a / 48 fully responsive prefix can cover 2 80 There are 20000000 active IPv6 addresses, but each address cannot correspond to a unique responder. Therefore, if the full response prefix is ​​ignored in network measurement activities, many detection resources may fall into the "full response prefix trap", which will not only waste a lot of resources and time, but also bring unnecessary deviations and may even distort the measurement conclusions. For example, in IPv6 active address detection, if the full response prefix is ​​not discovered in time, all detection resources may be gradually consumed by it, resulting in meager returns. In a dataset of 24.5 million active IPv6 addresses released on May 4, 2024, we found that 4.8 million addresses were under the full response prefix, accounting for 20% of the total. According to the 20%-50% hit rate of most current active address detection methods, this means that nearly 9.6 million to 24 million detections did not target the real active addresses, resulting in a waste of detection resources. Worse, when we conduct other network measurement activities (such as port scanning) based on these addresses, the measurement results may not accurately reflect the actual situation of the network, thus misleading.

[0004] Currently, there are few studies on full-response prefixes. Some active address detection works have found the existence of full-response prefixes in active address detection, and proposed a method similar to brute-force detection to verify the full-response prefixes in the detected active addresses. Sattler et al. also studied similar prefixes (high-response prefixes) under IPv4 through brute-force detection. However, under IPv6, even with high-speed tools such as ZMap and Masscan, it is impractical to brute-force detect the full-response prefixes of the entire Internet. This is because the address space of IPv6 is twice that of IPv4. 96 times.

[0005] Therefore, how to provide a long-term and efficient active detection method for all-response prefixes is a problem to be solved at present. Summary of the invention

[0006] Therefore, the technical problem to be solved by the present invention is to overcome the problem of low efficiency of full response prefix detection in the prior art.

[0007] In order to solve the above technical problems, the present invention provides an IPv6 full response prefix detection method, comprising:

[0008] Obtain Internet routing prefix data and known full response prefix data, and perform preprocessing;

[0009] Based on the known full-response prefix data, determining the largest-scale data set as a seed set;

[0010] Based on the Internet routing prefix data, using address space detection technology, determine a full response routing prefix and a non-full response routing prefix, and determine the non-full response routing prefix as a target prefix;

[0011] Based on the seed set, independently construct a search tree for each of the target prefixes;

[0012] Based on the search tree of each target prefix, all Internet response prefixes are detected.

[0013] Preferably, independently constructing a search tree for each target prefix based on the seed set includes:

[0014] Based on the seed set, the target prefix is ​​divided into a seeded prefix containing a seed and a seedless prefix not containing a seed;

[0015] For any seed prefix, create it as a root node, and recursively perform expansion and backtracking according to the service ID of the root node to build a search tree with the seed prefix;

[0016] For any seedless prefix, perform attribute matching with all seeded prefixes, merge the search trees of successfully matched seeded prefixes, and construct a search tree for seedless prefixes.

[0017] Preferably, recursively performing the expansion according to the service ID of the root node includes:

[0018] Starting from the root node, a seed path consisting of seed nodes is generated according to the seed service ID sequence;

[0019] All potential nodes are expanded for the seed nodes of each layer, and the potential nodes are associated with the parent nodes of the previous layer.

[0020] Preferably, recursively performing backtracking according to the service ID of the root node includes:

[0021] Since the seed contained in the seed prefix is ​​known full response prefix data, the known value on the seed path is updated according to the seed;

[0022] For any potential node, set its corresponding value and corresponding potential visit times according to its seed nodes in the same layer and its distance from the seed nodes;

[0023] The prefix represented by each node is marked as a complete response prefix, a non-complete response prefix, and an unknown prefix.

[0024] Preferably, the detecting of the Internet full response prefix based on the search tree of each target prefix includes:

[0025] For the search tree of any target prefix, starting from the root node, the optimal value node is recursively selected layer by layer to generate the optimal path. The optimal path cannot be completely consistent with the seed path, that is, the node at the last layer in the optimal path is a potential node;

[0026] Expanding n child nodes for the potential node selected in the last layer of the optimal path;

[0027] Expanding n addresses based on the selected potential node and the n child nodes;

[0028] Scan the n addresses online to determine whether they respond;

[0029] According to the alias prefix detection method, the response status of n addresses is detected and the value information of all nodes is updated through backpropagation.

[0030] Preferably, for any seedless prefix, attribute matching is performed on it with all seeded prefixes, and search trees of successfully matched seeded prefixes are merged to construct a search tree of seedless prefixes, which includes:

[0031] For any seedless prefix, get its subordinate AS and match it with all subordinate ASs with seed prefix;

[0032] If the match is successful, all the matched search trees with seed prefixes that do not contain the root node are merged, and the value information of nodes from different search trees is accumulated and combined until the root node is successfully set to the corresponding seedless prefix;

[0033] If a seeded prefix cannot be matched based on the subordinate AS, a match is performed layer by layer based on the organization or service category to which the seedless prefix belongs.

[0034] Preferably, the search tree based on each target prefix, after detecting the full response prefix of the Internet, further comprises:

[0035] Generate a full response prefix list according to the detected full response prefixes;

[0036] The known full response prefix data is updated according to the full response prefix list so as to perform the next round of detection.

[0037] The present invention also provides an IPv6 full response prefix detection device, comprising:

[0038] A data acquisition module, used to acquire Internet routing prefix data and known full response prefix data, and perform preprocessing;

[0039] A seed set acquisition module, used for determining the largest-scale data set as a seed set based on the known full-response prefix data;

[0040] A target prefix determination module, configured to determine a fully responsive routing prefix and a non-fully responsive routing prefix based on the Internet routing prefix data and using an address space detection technology, and to determine the non-fully responsive routing prefix as a target prefix;

[0041] A search tree construction module, used for independently constructing a search tree for each target prefix based on the seed set;

[0042] The detection module is used to detect all Internet response prefixes based on the search tree of each target prefix.

[0043] The present invention also provides an IPv6 full response prefix detection device, comprising:

[0044] Memory for storing computer programs;

[0045] A processor is used to implement the above-mentioned steps of the IPv6 full response prefix detection method when executing the computer program.

[0046] The present invention also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned IPv6 full response prefix detection method are implemented.

[0047] The above technical solution of the present invention has the following advantages compared with the prior art:

[0048] The IPv6 full response prefix detection method of the present invention first pre-processes the Internet routing prefix data and known full response prefix data obtained from public channels. For known full response prefixes, we select the largest data set as the seed set. For Internet routing prefixes, we use address space detection technology to distinguish between full response routing prefixes (FRRP) and non-full response routing prefixes (NFRRP, i.e., target prefixes). After the module for building the search tree obtains all target prefixes and seed data, it will independently build search trees for these prefixes. Subsequently, the full response prefix detection module takes the search trees of all target prefixes as input and continuously explores new full response prefixes. Finally, all detected full response prefixes are output and a full response prefix list is formed. In addition, this list can be used to update the known full response prefix data for the next round of detection. The present invention mines and utilizes knowledge (i.e., address mode) useful for detecting active prefixes under the target prefix from the existing seed prefixes to improve the efficiency of target prefix detection, and then enriches the seed prefix library by detecting new prefixes; the present invention can actively detect IPv6 full response prefixes for any routing prefix and always maintain a high hit rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to make the content of the present invention more clearly understood, the present invention is further described in detail below according to specific embodiments of the present invention in conjunction with the accompanying drawings, wherein:

[0050] Figure 1 It is a flow chart of an implementation of an IPv6 full response prefix detection method provided by the present invention;

[0051] Figure 2 This is the implementation flow chart of Luori, an IPv6 full response prefix detection method based on reinforcement learning;

[0052] Figure 3 This is a schematic diagram of the establishment of a search tree;

[0053] Figure 4 This is a schematic diagram of the IPv6 full response prefix detection process. DETAILED DESCRIPTION

[0054] The core of the present invention is to provide an IPv6 full response prefix detection method, device, equipment and computer storage medium, which effectively improves the efficiency of IPv6 full response prefix detection.

[0055] In order to enable those skilled in the art to better understand the scheme of the present invention, the present invention is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0056] Please refer to Figure 1 , Figure 1 The following is a flowchart of an implementation method of an IPv6 full response prefix detection method provided by the present invention; the specific operation steps are as follows:

[0057] S101: Obtain Internet routing prefix data and known full response prefix data, and perform preprocessing;

[0058] S102: Based on the known full response prefix data, determine the largest data set as a seed set;

[0059] S103: Based on the Internet routing prefix data, using address space detection technology, determine the full response routing prefix and the non-full response routing prefix, and determine the non-full response routing prefix as the target prefix;

[0060] S104: Based on the seed set, independently construct a search tree for each target prefix;

[0061] S105: Based on the search tree of each target prefix, detect the full response prefix of the Internet.

[0062] The present invention aims to propose an efficient active detection method for the full response prefix of the whole network, and to perform long-term detection, so as to construct and maintain the full response prefix list of the whole network (full response prefix list) for a long time. On the one hand, the full response prefix list can help researchers reduce the impact of the full response prefix on their measurement activities, and serve as a data set to reduce the unnecessary network burden caused by redundant measurements. On the other hand, it can also reveal the status and characteristics of a large number of full response prefixes in the whole network, which is helpful to explore its usage scenarios and implementation methods, and provide in-depth insights for its practical application. Therefore, the present invention proposes a reinforcement learning-based IPv6 full response prefix detection method Luori, which can actively detect IPv6 full response prefixes for any routing prefix and always maintain a high hit rate. The core idea is to mine and utilize the knowledge (i.e., address mode) useful for detecting active prefixes under the target prefix from the existing seed prefixes to improve the efficiency of the target prefix detection, and then enrich the seed prefix library by detecting new prefixes.

[0063] like Figure 2 As shown, in this method, we independently create a search tree for each target prefix, which not only reflects the entire detection space under the target prefix, but also reveals the possibility of the full response prefix pattern. Then, using the search tree of each target prefix, we continuously generate candidate full response prefixes and determine whether they are true full response prefixes through active detection.

[0064] When conducting global full-response prefix detection, we first preprocess the Internet routing prefix data and known full-response prefix data obtained from public channels. For known full-response prefixes, we select the largest data set as the seed set. For Internet routing prefixes, we use address space detection technology to generate 16 sub-prefixes in hexadecimal after the routing prefix, and generate 1 random probe for each sub-prefix, a total of 16 probes, and send ICMPv6 messages to detect whether they are active. If all 16 probes are active, it is judged as a full-response routing prefix (FRRP), so as to distinguish between full-response routing prefixes (FRRP) and non-full-response routing prefixes (NFRRP, i.e. target prefixes). After the search tree construction module obtains all target prefixes and seed data, it will independently build search trees for these prefixes. Subsequently, the full-response prefix detection module takes the search trees of all target prefixes as input and continuously explores new full-response prefixes. Finally, Luori will output all detected full-response prefixes and form a list of full-response prefixes. In addition, this list can be used to update the known full-response prefix data for the next round of detection.

[0065] Based on the above embodiments, this embodiment describes step S104 in detail:

[0066] S401: Based on the seed set, the target prefix is ​​divided into a seeded prefix containing a seed and a seedless prefix not containing a seed;

[0067] S402: For any seed prefix, create it as a root node, and recursively perform expansion and backtracking according to the service ID of the root node to build a search tree with the seed prefix;

[0068] For target prefixes that contain seeds (i.e., there are seed prefixes), we can directly construct the search tree. Figure 3 As shown in the figure, when building a search tree based on a seed with a seed prefix, we first create a root node (i.e., a seeded routing prefix), and then recursively perform expansion and backpropagation based on the SID (service ID) of each seed to build a complete search tree. Different levels of the search tree represent prefixes of different lengths, and each node can represent a prefix (i.e., the path to the node). In addition, the state of each node is reflected by the value of the node (for example, whether it is a full response prefix or not). All nodes and their states represent the full response prefix pattern of the target prefix, and as the node state changes, the full response prefix pattern will also change dynamically.

[0069] S403: For any seedless prefix, perform attribute matching on it and all seeded prefixes, merge the search trees of successfully matched seeded prefixes, and construct a search tree of seedless prefixes.

[0070] Since the seeds are finite, most target prefixes have no seeds (i.e., seedless prefixes). For such prefixes, we propose a cross-prefix search tree transfer strategy to build the search tree.

[0071] Based on the above embodiments, this embodiment describes step S402 in detail:

[0072] We expand directly from the root node according to the SID of each seed. The depth of expansion is determined by the length of the SID. Specifically, the expansion includes two parts: seed node expansion and potential node expansion.

[0073] S4021: Starting from the root node, a seed path consisting of seed nodes is generated according to the seed service ID sequence;

[0074] Seed node expansion refers to direct expansion from top to bottom in the tree, following the left-to-right order of the seed SIDs. This process forms a seed path in the tree, consisting of seed nodes, representing a known successful search path (i.e., a fully responsive prefix). The core of relying on seed guidance is that the seed pattern can initially represent the overall pattern of the target prefix, that is, the probability of the existence of potential fully responsive prefixes s in the seed region (immediately adjacent to the seed node) is higher because they share a consistent pattern.

[0075] S4022: Expand all potential nodes for the seed nodes of each layer, and associate the potential nodes with the parent nodes of the previous layer.

[0076] We also perform latent node expansion on a single seed node on the seed path. Specifically, all latent nodes in the same layer as the seed node (i.e., 0-f) are first expanded, and then associated with their parent nodes in the upper layer.

[0077] like Figure 3 As shown, in a specific example:

[0078] When there is a seed prefix of 2001:5af3:: / 32 (i.e., the root node), x=32. If one of its seeds is 2001:5af3:1f90:: / 44, and assuming that it is the first seed in the recursive process, its SID is "1f9". The expanded seed nodes are "1", "f", and "9", forming a seed path. The other expanded nodes are potential nodes. The depth of expansion reaches the 4th level. Each node in the tree represents a prefix. For example, the potential node "2" in the 2nd level represents the prefix 2001:5af3:2000:: / 36, and the leaf seed node "9" in the 4th level represents the seed 2001:5af3:1f90:: / 44. However, it should be noted that a non-leaf seed node does not represent a seed because it is just a parent prefix of the seed. For example, the parent prefix represented by the seed node "f" in the 3rd level is 2001:5af3:1f00:: / 40.

[0079] The goal of backpropagation is to update the state of each node layer (i.e., V information) in reverse, starting from the leaf seed node until the root node is reached. This stage also mainly consists of two parts: known value backpropagation and potential value backpropagation.

[0080] S4023: Since the seed included in the seed prefix is ​​known full response prefix data, the known value on the seed path is updated according to the seed;

[0081] In known value backtracking, since the seed is a known full response prefix (full response prefix), the known values ​​(Vk) of all seed nodes on the seed path will be updated.

[0082] S4024: For any potential node, set its corresponding value and corresponding potential visit times according to its seed node in the same layer and the distance from the seed node;

[0083] In the back propagation of potential value, the potential node receives the value (Vp) from the adjacent seed node. The Vp obtained by different potential nodes from a seed node will gradually decrease from near to far (i.e., Vp = v--), because the closer to the seed pattern, the more likely it is a full response prefix (full response prefix). At the same time, the potential number of visits to the potential node (Np) will also increase by 1 (i.e., Np+ = 1).

[0084] However, their Vp and Np will not be propagated upwards because they have not actually been visited and have no known value. They just have a higher probability of becoming full-response prefix nodes, and their true value needs further exploration.

[0085] S4025: Mark the prefix represented by each node as a full response prefix, a non-full response prefix, and an unknown prefix.

[0086] We also mark whether the prefix represented by the node is a fully responsive prefix. A flag value (Vf) of 0 indicates a non-fully responsive prefix (N fully responsive prefix), Vf=1 indicates a fully responsive prefix (e.g., seed), and Vf=2 indicates unknown.

[0087] like Figure 3 , in a specific example:

[0088] The current state of the search tree after expansion and back propagation based on the first seed 2001:5af3:1f90:: / 44 at v=16. The root node (i.e., the seed prefix) is predetermined to be a non-fully responsive routing prefix (NFRRP), so Vf=0. The seed node "9" (i.e., the seed) in layer 4 has Vf=1, and all other nodes have Vf=2. Note that the Vf of seed nodes "1" and "f" is also 2 because the parent prefix of the seed may also be a fully responsive prefix.

[0089] Based on the above embodiments, this embodiment describes step S403 in detail:

[0090] As the above process is recursively executed, the state of this node will undergo constant changes. The Vk, Nk, Vp, and Np of the node will continue to accumulate, and Vf may also change. For example, when a new seed is loaded, the Vf of the potential node may change from 2 to 1. When all seeds are loaded into a search tree under a seed prefix, this search tree represents the current full-response prefix (full-response prefix) pattern of the seed prefix and its entire potential detection space (because the tree can continue to expand), and then the subsequent full-response prefix detection process is started. However, for seedless prefixes, since they do not have any prior knowledge (i.e., seeds), the full-response prefix pattern is completely unknown. Therefore, we also propose an inter-prefix search tree transfer strategy, whose goal is to transfer some potential similar search trees (i.e., full-response prefix patterns) from the seed prefix to each seedless prefix. Otherwise, it is difficult to start the detection.

[0091] The core of this strategy is that target prefixes with the same attributes (e.g., AS) have similar full-response prefix patterns, that is, the relevant attributes of the target prefix are used to divert the search tree. First, based on network management experience, prefixes with similar attributes are likely to have consistent configurations because they usually have consistent use cases and are managed by the same network engineers. This experience is also applied to similar tasks such as active address detection. In addition, we also conducted tests based on three selected attributes of subordinate AS, organization, and business category. We found that the seed information entropy under a single attribute is reduced relative to the information entropy of all seeds, especially AS. Therefore, based on these three attributes, we designed a hierarchical transfer strategy from fine-grained to coarse-grained.

[0092] S4031: For any seedless prefix, obtain its subordinate AS and match it with all subordinate ASs with seed prefixes;

[0093] S4032: If the match is successful, merge all the matched search trees with seed prefixes that do not contain the root node, and accumulate and combine the value information of the nodes from different search trees until the root node is successfully set to the corresponding seedless prefix;

[0094] For a seedless prefix, we first get its AS and then match it with the AS to which all seed prefixes belong. If a match is successful, the search trees of all matching seed prefixes (excluding the root node) are merged to create a new tree. During the merging process, nodes from different trees are combined and the value information of the nodes is accumulated. Once the root node is set to the seedless prefix, the search tree transfer is completed.

[0095] S4033: If the seed prefix cannot be matched according to the subordinate AS, matching is performed layer by layer according to the organization or business category to which the seedless prefix belongs.

[0096] If any search tree cannot match based on AS, then the prefix will be matched layer by layer based on the organization or business category to which it belongs. Since the granularity of business category is very coarse, all target prefixes will eventually get a search tree.

[0097] Based on the above embodiments, this embodiment describes step S105 in detail:

[0098] Since the search tree can be continuously expanded, its search space is huge. At the same time, the seed patterns may not fully represent the fully responsive prefix patterns under the target prefix, for example, they may be incomplete. Therefore, relying solely on seed patterns for detection may result in a large number of fully responsive prefixes being missed. To address this issue, we need to balance the depth and breadth of the search to ensure comprehensive coverage of the potential fully responsive prefix space.

[0099] Since the number of fully responsive prefixes has not been discovered, to address this challenge, based on the idea of ​​reinforcement learning, we propose a clever ∈-Q strategy that puts limited detection resources on more valuable branches to discover more new fully responsive prefixes s. And this tree will be continuously updated according to the detection feedback (i.e., pattern) so that ∈-Q can make the best decision in real time. Figure 4 The workflow of dynamic probing is shown, which iteratively executes the selection, probing, and back-propagation modules according to the budget (B) of each target prefix.

[0100] S1051: For a search tree of any target prefix, starting from the root node, recursively select the optimal value node layer by layer to generate an optimal path. The optimal path cannot be completely consistent with the seed path, that is, the node at the last layer in the optimal path is a potential node;

[0101] First, we want to select the most valuable branch in the current search tree state (i.e., generate a candidate full-response prefix). The recursive selection process starting from the root node is usually completed through a strategy, the core of which is to use the value information of the nodes in the current state of the tree to make the best choice. However, this optimal choice does not always select nodes that are known to be better (for example, seed nodes "1" and "f"). Although we choose along the seed path as much as possible (i.e., using existing seed prior knowledge), it also needs to be able to select other unknown paths (i.e., explore the space where seeds do not exist) to avoid falling into the seed mode without any chance to discover more other full-response prefix patterns. In order to achieve a balance between utilization and exploration, the present invention designs a selection strategy ∈-Q based on the ∈-Greedy algorithm.

[0102] S1052: Expand n child nodes for the potential node selected in the last layer of the optimal path;

[0103] For the selected node, we first expand its child nodes, i.e. create a total of 16 child nodes from 0 to f.

[0104] S1053: Expand n addresses based on the selected potential node and the n child nodes;

[0105] These 16 addresses are randomly expanded based on the selected node and the expanded children.

[0106] S1054: Scan the n addresses online to determine whether they respond;

[0107] These 16 addresses are scanned online by sending ICMPv6 requests to determine if they respond, as these addresses reflect the state of the selected node and possible states of the child nodes.

[0108] like Figure 4 As shown, in a specific example:

[0109] Based on the selected "1f8", the 16 addresses obtained by expansion are 2003:89af:0011:1f8{0-f}:****:****:****:****:****.

[0110] Perhaps only the address 2003:89af:0011:1f8{0-1}:****:****:****:**** is responsive.

[0111] S1055: Detect the response status of n addresses according to the alias prefix detection method and back-propagate to update the value information of all nodes.

[0112] According to the response status of the 16 addresses in the alias prefix detection method (APD) detection and update the node value information (i.e. the state of the tree), starting from the expanded 16 child nodes, reverse layer by layer until the root node is reached. It should be noted that once a potential node is selected and the detection is performed, it will be transformed into a known node. Before performing backpropagation, its value information will be converted from Vp and Np to Vk and Nk and initialized to 0.

[0113] Specifically, the following three situations will occur:

[0114] Case 1: When all 16 addresses have responses, the selected node is a fully responsive prefix. At this point, consistent with the backpropagation in the search tree construction, the Vk and Nk of all nodes on the selected path will be increased by v and 1 respectively. The corresponding Vp (i.e., v--) will be propagated to the potential nodes. In addition, the Vf of the selected node is set to 1, and the extended child nodes will be pruned.

[0115] Case 2: When 16 addresses partially respond (e.g., only m addresses respond), the Vk and Nk of all nodes on the selected path will increase by m and 1 respectively. The Vp and Np of the responding child nodes increase by 1, and the Vp of the non-responding child nodes is 0 but the Np increases by 1.

[0116] Case 3: When all 16 addresses do not respond, the Vk of the selected node is 0 and no backpropagation is performed, but the Nk of all nodes on the selected path will be increased by 1. Similarly, the Vp of all child nodes is 0 but Np is increased by 1. In addition, for cases 2 and 3, the Vf of the selected node is set to 0 and the Vf of all its extended child nodes is set to 2. After the value information is updated in reverse, the detection feedback is propagated to the entire prefix space to optimize the next detection.

[0117] like Figure 4 As shown, in a specific example:

[0118] Based on the detection results, the Vk of the selected node "8" is updated to 2 and back-propagated to the root node, and its Vf is updated to 0. The Vp and Np of "0" and "1" in the expanded child nodes are updated to 1. The Vp of other expanded child nodes is 0. The Vf of all expanded child nodes is 2.

[0119] S1056: Generate a full response prefix list according to the detected full response prefix;

[0120] S1057: Update the known full response prefix data according to the full response prefix list to facilitate the next round of detection.

[0121] The present invention proposes an Internet-wide full-response prefix detection method, which can perform IPv6 full-response prefix detection on any routing prefix.

[0122] In order to accurately process full response prefixes of different lengths and patterns, the present invention proposes to use the natural hierarchical characteristics of the tree to represent the entire full response prefix detection space. In order to further accurately represent the pattern of the full response prefix, the tree structure is converted into a search tree, each node of which represents not only a prefix but also the current state.

[0123] The present invention is based on the idea of ​​reinforcement learning and transforms the active detection process under the huge prefix space of IPv6 into a dynamic search process in a tree based on reinforcement learning.

[0124] In order to be applicable to all routing prefixes in the Internet, the present invention designs a search tree migration strategy based on prefix attributes for routing prefixes without seeds.

[0125] This paper is the first known Internet-wide full-response prefix active detection method. Based on a real seed data set, Luori performs a single detection of all routing prefixes announced by BGP and finds 31.7K full-response prefixes, covering 1.5×1.5*10 30 The address space is 1.3*10 of the current brute force detection method. 33 times.

[0126] So far, Luori has been continuously detecting the Internet for nearly six months and has discovered 516K full-response prefixes, covering 1.3×1.3*10 33 The address space and 795 ASs far exceed the existing full-response prefix list, making it the largest known public full-response prefix list.

[0127] For the well-known and commonly used IPv6 active address dataset, we found that 20% of the addresses belong to the full response prefixes we provided. In addition, we also analyzed and found that the full response prefixes in the full response prefix list mainly come from about 650 organizations in industries such as cloud or CDN services and network security. At the same time, the implementation of full response prefixes is also diverse. In addition to the specific technical means of cloud or CDN vendors (such as Cloudflare's addressing agile method), most of them are implemented based on the existing functions of the Linux system.

[0128] The present invention promotes the research of the academic community in the fields of network measurement, network mapping, network security, etc. IPv6 full response prefix detection establishes a full response prefix list to provide data support for network measurement, network mapping, network security, etc.

[0129] The present invention supports the IPv6 network productization in the industrial network measurement field and security field. The detected full response prefix can effectively remove the false addresses (addresses under the full response prefix) in the active IPv6 addresses. The cleaned IPv6 active addresses better support the promotion of network measurement industry products in the next generation Internet field, and further support the expansion of security companies' products in IPv6 networks.

[0130] The detection of the full response prefix of the present invention is conducive to mastering the status of one's own IPv6 network, ensuring the security of national information network, and occupying the commanding heights and initiative of network security. The established full response prefix list is also an important basis for network attacks such as service identification and positioning, vulnerability discovery, and penetration testing.

[0131] An embodiment of the present invention provides an IPv6 full response prefix detection device; the specific device may include:

[0132] A data acquisition module, used to acquire Internet routing prefix data and known full response prefix data, and perform preprocessing;

[0133] A seed set acquisition module, used for determining the largest-scale data set as a seed set based on the known full-response prefix data;

[0134] A target prefix determination module, configured to determine a fully responsive routing prefix and a non-fully responsive routing prefix based on the Internet routing prefix data and using an address space detection technology, and to determine the non-fully responsive routing prefix as a target prefix;

[0135] A search tree construction module, used for independently constructing a search tree for each target prefix based on the seed set;

[0136] The detection module is used to detect all Internet response prefixes based on the search tree of each target prefix.

[0137] The IPv6 full response prefix detection device of this embodiment is used to implement the aforementioned IPv6 full response prefix detection method. Therefore, the specific implementation method of the IPv6 full response prefix detection device can be seen in the embodiment part of the aforementioned IPv6 full response prefix detection method. For example, the data acquisition module, the seed set acquisition module, the target prefix determination module, the search tree construction module, and the detection module are respectively used to implement steps S101, S102, S103, S104 and S105 in the aforementioned IPv6 full response prefix detection method. Therefore, its specific implementation method can refer to the description of the corresponding various parts of the embodiment, which will not be repeated here.

[0138] A specific embodiment of the present invention also provides an IPv6 full response prefix detection device, including: a memory for storing a computer program; a processor for implementing the steps of the above-mentioned IPv6 full response prefix detection method when executing the computer program.

[0139] A specific embodiment of the present invention further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned IPv6 full response prefix detection method are implemented.

[0140] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0141] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0142] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0143] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0144] Obviously, the above embodiments are merely examples for the purpose of clear explanation and are not intended to limit the implementation methods. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived therefrom are still within the scope of protection of the present invention.

Claims

1. An IPv6 full response prefix detection method, characterized in that: include: Obtain Internet routing prefix data and known full response prefix data, and perform preprocessing; Based on the known full-response prefix data, determining the largest-scale data set as a seed set; Based on the Internet routing prefix data, using address space detection technology, determine a full response routing prefix and a non-full response routing prefix, and determine the non-full response routing prefix as a target prefix; Based on the seed set, independently construct a search tree for each of the target prefixes; Based on the search tree of each target prefix, all Internet response prefixes are detected.

2. The IPv6 full response prefix detection method according to claim 1, characterized in that: The independently constructing a search tree for each target prefix based on the seed set includes: Based on the seed set, the target prefix is ​​divided into a seeded prefix containing a seed and a seedless prefix not containing a seed; For any seed prefix, create it as a root node, and recursively perform expansion and backtracking according to the service ID of the root node to build a search tree with the seed prefix; For any seedless prefix, perform attribute matching with all seeded prefixes, merge the search trees of successfully matched seeded prefixes, and construct a search tree for seedless prefixes.

3. The IPv6 full response prefix detection method according to claim 2, characterized in that: Recursively executing the expansion according to the service ID of the root node includes: Starting from the root node, a seed path consisting of seed nodes is generated according to the seed service ID sequence; All potential nodes are expanded for the seed nodes of each layer, and the potential nodes are associated with the parent nodes of the previous layer.

4. The IPv6 full response prefix detection method according to claim 3, characterized in that: Recursively performing backtracking according to the service ID of the root node includes: Since the seed contained in the seed prefix is ​​known full response prefix data, the known value on the seed path is updated according to the seed; For any potential node, set its corresponding value and corresponding potential visit times according to its seed nodes in the same layer and its distance from the seed nodes; The prefix represented by each node is marked as a complete response prefix, a non-complete response prefix, and an unknown prefix.

5. The IPv6 full response prefix detection method according to claim 4, characterized in that: The detecting of the Internet full response prefix based on the search tree of each target prefix includes: For the search tree of any target prefix, starting from the root node, the optimal value node is recursively selected layer by layer to generate the optimal path. The optimal path cannot be completely consistent with the seed path, that is, the node at the last layer in the optimal path is a potential node; Expanding n child nodes for the potential node selected in the last layer of the optimal path; Expanding n addresses based on the selected potential node and the n child nodes; Scan the n addresses online to determine whether they respond; According to the alias prefix detection method, the response status of n addresses is detected and the value information of all nodes is updated through backpropagation.

6. The IPv6 full response prefix detection method according to claim 2, characterized in that: For any seedless prefix, attribute matching is performed on it with all seeded prefixes, and the search trees of the seeded prefixes that have been successfully matched are merged to construct the search tree of the seedless prefix, which includes: For any seedless prefix, get its subordinate AS and match it with all subordinate ASs with seed prefix; If the match is successful, all the matched search trees with seed prefixes that do not contain the root node are merged, and the value information of nodes from different search trees is accumulated and combined until the root node is successfully set to the corresponding seedless prefix; If a seeded prefix cannot be matched based on the subordinate AS, a match is performed layer by layer based on the organization or service category to which the seedless prefix belongs.

7. The IPv6 full response prefix detection method according to claim 1, characterized in that: The search tree based on each target prefix, after detecting the full response prefix of the Internet, further includes: Generate a full response prefix list according to the detected full response prefixes; The known full response prefix data is updated according to the full response prefix list so as to perform the next round of detection.

8. An IPv6 full response prefix detection device, characterized in that: include: A data acquisition module, used to acquire Internet routing prefix data and known full response prefix data, and perform preprocessing; A seed set acquisition module, used for determining the largest-scale data set as a seed set based on the known full-response prefix data; A target prefix determination module, configured to determine a fully responsive routing prefix and a non-fully responsive routing prefix based on the Internet routing prefix data and using an address space detection technology, and to determine the non-fully responsive routing prefix as a target prefix; A search tree construction module, used for independently constructing a search tree for each target prefix based on the seed set; The detection module is used to detect all Internet response prefixes based on the search tree of each target prefix.

9. An IPv6 full response prefix detection device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of an IPv6 full response prefix detection method as claimed in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the IPv6 full response prefix detection method as claimed in any one of claims 1 to 7 are implemented.

Images