Unified address and port mapping ipv6 asset efficient discovery method and system

Abstract

The application provides an IPv6 asset efficient discovery method and system for unified address and port mapping, wherein the method comprises the following steps: screening IPv6 stable active addresses, counting open ports, generating port pairs, repeatedly extracting port set patterns, realizing unified coding of the address and the port, and recording the asset coding; taking the asset coding as the input, constructing a tree structure by using the density clustering idea, extracting the distribution pattern of high-density active assets, and generating high-probability active target assets; embedding the detection identifier, round and coding information in the TCP sequence number field to realize the stateless detection of the target assets, and simultaneously performing alias detection to determine whether it is an alias prefix; matching the newly detected active assets with the alias prefix list, filtering if matched, determining as an alias asset if not matched, adding the / 64 prefix to the alias prefix list, updating the list, and dynamically iterating the detection combined with the node reward value. The application realizes the IPv6 asset efficient discovery.

Description

Technical Field

[0001] This invention relates to the fields of network measurement and IPv6 security technology, and in particular to an efficient method and system for discovering IPv6 assets with unified address and port mapping. Background Technology

[0002] With the widespread adoption of cloud computing, 5G, and IoT technologies, the number of network devices is exploding, and the IPv4 address space can no longer meet the demand. IPv6, as the next-generation internet protocol, is being deployed at an accelerated pace globally. Network research, security protection, and operation and maintenance management all rely on the accurate discovery of active IPv6 assets (i.e., IP-port pairs of "IPv6 address + corresponding open port"). However, existing IPv6 asset discovery methods have four key flaws: 1. Low detection efficiency: The two-stage mode of "first detecting active addresses through ICMPv6, and then predicting open ports for active addresses" cannot prioritize the allocation of detection resources to the most likely active IP-port pairs, resulting in wasted resources and low efficiency. 2. Missing ICMP-Inactive Assets: Most methods rely on ICMPv6 probes to determine address activity, but many devices only respond to TCPSYN probes and not ICMPv6, so these ICMP-Inactive assets are completely missed. 3. Alias ​​Asset Confusion: In IPv6 networks, there are "alias prefixes" (all addresses under the same prefix are mapped to the same physical device). Existing detection methods are affected by rate limiting policies and do not combine port information, so they cannot identify alias assets in ICMP-Inactive assets, resulting in "fake nodes" in the detection results. 4. Low availability of the hit list: In the existing IPv6 active address list (Hitlist), more than 80% of the addresses have no open ports, which cannot support upper-layer service analysis, security assessment and other applications.

[0003] The aforementioned shortcomings make it difficult for existing technologies to meet the needs of efficient, comprehensive, and accurate asset discovery in large-scale IPv6 networks, and there is an urgent need for a new IPv6 asset discovery solution that can overcome the above bottlenecks. Summary of the Invention

[0004] The present invention aims to at least partially solve one of the technical problems in the related art.

[0005] Therefore, the first objective of this invention is to propose an efficient method for discovering IPv6 assets with unified address and port mapping.

[0006] The second objective of this invention is to propose an efficient IPv6 asset discovery system with unified address and port mapping.

[0007] The third objective of this invention is to provide an electronic device.

[0008] The fourth objective of this invention is to provide a computer-readable storage medium.

[0009] The fifth objective of this invention is to provide a computer program product.

[0010] To achieve the above objectives, a first aspect of the present invention proposes an efficient method for IPv6 asset discovery with unified address and port mapping, comprising: Filter stable and active IPv6 addresses and count open ports, generate port pairs, repeatedly extract port set patterns and remove related port pairs to form an association mapping table, realize unified encoding of addresses and ports, and record it as asset code; Using asset codes as input, a tree structure is constructed using density clustering to extract the distribution patterns of high-density active assets and generate high-probability active target assets. By embedding probe identifiers, rounds, and encoding information in the TCP sequence number field, stateless probes of target assets are achieved. At the same time, alias detection is performed to determine whether it is an alias prefix, and assets under it are recorded as alias assets. The newly detected active assets are matched with the alias prefix list. If a match is found, the assets are filtered out. If no match is found, the assets are identified as alias assets, their / 64 prefix is ​​added to the alias prefix list, the list is updated, and the detection is dynamically iterated in combination with node reward values ​​to achieve efficient discovery of IPv6 assets.

[0011] Optionally, the process of filtering stable and active IPv6 addresses and counting open ports, generating port pairs, repeatedly extracting port set patterns and removing related port pairs to form an association mapping table, achieving unified encoding of addresses and ports, and recording it as an asset code, includes: Filter stable and active addresses from the existing list of active IPv6 addresses, scan and count the open ports of each address; For each address's open port, generate all port pairs, defining them as symbiotic port pairs; for ports not appearing in the open ports, generate self-looping port pairs to ensure that all ports from 0 to 65535 are covered. Filter the ports that appear most frequently from all port pairs, select the 15 ports that appear most often together with them, form a set of 16 ports, extract the pattern of this set, and remove all port pairs that contain these 16 ports from the port pair set; Repeat the above operation until the port pair set is empty, and finally form an association mapping table for subsequent unified encoding of ports and addresses.

[0012] Optionally, the step of using asset codes as input, constructing a tree structure using density clustering, extracting the distribution patterns of high-density active assets, and generating high-probability active target assets further includes: The asset codes of seed assets are converted into high-dimensional vectors to construct the root node of the asset space tree, which corresponds to all seed assets. Calculate the entropy value of each half-byte in all asset codes under each node, select the half-byte with the lowest entropy value as the splitting dimension, and split the node into multiple child nodes until the number of asset vectors under the child nodes is lower than a preset threshold. For each node, extract the half-byte pattern of the asset codes it covers; this pattern is the high-probability active asset pattern. Based on the high-probability active asset patterns of each node, all asset codes that conform to the pattern are generated, which are the target assets to be detected.

[0013] Optionally, embedding probe identifiers, round numbers, and encoding information into the TCP sequence number field to achieve stateless probe of the target asset includes: The sequence number field is set to 32 bits in total. The first 4 bits are the probe identifier, the next 4 bits are the probe round, and the last 24 bits are the node code, which is the unique identifier of the node in the corresponding asset space tree. The receiving end can parse the probe round and node code by decrementing the acknowledgment number by 1 and sorting it in big-endian order, without needing to maintain the transmission status.

[0014] Optionally, the simultaneous alias detection to determine whether it is an alias prefix, with assets under it being recorded as alias assets, includes: For detected active assets, extract the / 64 prefix of their IPv6 address and group all active assets with the same / 64 prefix together; For each / 64 prefix, 16 different IPv6 addresses are randomly generated by modifying the last 64 bits of the address. Each address is paired with one randomly observed open port under that prefix to form 16 assets to be detected. TCP SYN probe packets are sent to 16 assets to be tested. If more than 10 probe responses are received, the / 64 prefix is ​​determined to be an alias prefix, and all assets under it are alias assets.

[0015] Optionally, the dynamic iterative detection combined with node reward values ​​includes: The Thompson sampling algorithm is introduced, and a node reward value is defined. After each probe, the reward value of each node is updated. The next round of probe prioritizes the node with the highest reward value and generates target assets based on its pattern, ensuring that probe resources are tilted towards high-probability active areas and reducing invalid probes.

[0016] To achieve the above objectives, a second aspect of the present invention proposes an efficient IPv6 asset discovery system with unified address and port mapping, comprising: The association mapping table module filters stable and active IPv6 addresses and counts open ports, generates port pairs, repeatedly extracts port set patterns and removes related port pairs to form an association mapping table, realizes unified encoding of addresses and ports, and records them as asset codes; The asset spatial tree module takes asset codes as input, uses density clustering to construct a tree structure, extracts the distribution patterns of high-density active assets, and generates high-probability active target assets. The stateless TCP scanning optimization module achieves stateless detection of target assets by embedding probe identifiers, rounds, and encoding information in the TCP sequence number field. At the same time, it performs alias detection to determine whether it is an alias prefix, and assets under it are recorded as alias assets. The list update and dynamic feedback module matches newly detected active assets with the alias prefix list. If a match is found, the asset is filtered; otherwise, it is determined to be an alias asset, its / 64 prefix is ​​added to the alias prefix list, the list is updated, and the detection is dynamically iterated in combination with the node reward value.

[0017] To achieve the above objectives, a third aspect of the present invention provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of the first aspects.

[0018] To achieve the above objectives, a fourth aspect of the present invention provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of the first aspects.

[0019] To achieve the above objectives, a fifth aspect of the present invention provides a computer program product that, when executed by a processor, implements the method described in any one of the first aspects.

[0020] The technical solutions provided by the embodiments of the present invention bring at least the following beneficial effects: 1. Detection efficiency is significantly improved, greatly reducing the detection resource and time costs of large-scale IPv6 networks.

[0021] 2. Fill the gaps in ICMP-Inactive asset detection to achieve comprehensive asset discovery.

[0022] 3. Eliminate interference from aliased assets to ensure that the detection results accurately reflect the distribution of physical equipment and avoid wasting resources.

[0023] 4. Build a high availability asset list. Through large-scale probing, a hit list containing 306.2M IPv6 assets can be generated.

[0024] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0025] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 This is a flowchart illustrating an efficient IPv6 asset discovery method with unified address and port mapping provided in an embodiment of the present invention. Figure 2 A schematic diagram illustrating the framework of an efficient IPv6 asset discovery method with unified address and port mapping provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the stateless address detection principle provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the CAPD principle provided in an embodiment of the present invention; Figure 5 A schematic diagram illustrating the hit rate advantage of an efficient IPv6 asset discovery method with unified address and port mapping provided in an embodiment of the present invention; Figure 6 This is a schematic diagram of the IPv6 Asset Hitlist provided in an embodiment of the present invention; Figure 7 This is a schematic diagram of the structure of an efficient IPv6 asset discovery system with unified address and port mapping provided in an embodiment of the present invention. Detailed Implementation

[0026] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0027] This invention provides an efficient method for discovering IPv6 assets using unified address and port mapping. Figure 1 This is a flowchart illustrating an efficient IPv6 asset discovery method with unified address and port mapping provided in an embodiment of the present invention. (Refer to...) Figure 1 and Figure 2 The method includes the following steps: Step 101: Filter stable and active IPv6 addresses and count open ports, generate port pairs, repeatedly extract port set patterns and remove related port pairs to form an association mapping table, realize unified encoding of addresses and ports, and record it as asset code.

[0028] In this embodiment, stable and active addresses are selected from the existing list of active IPv6 addresses, such as addresses that have remained active for a week. The open ports of each address are scanned and counted. For each address's open ports, all "port pairs" (unordered, i.e., the combination of port A and port B is counted as 1 port pair) are generated and defined as "coexisting port pairs".

[0029] Then, for ports that do not appear in the open ports, "self-looping port pairs" (i.e., combinations of ports themselves) are generated to ensure that all ports from 0 to 65535 are covered. The ports with the highest frequency of occurrence are selected from all port pairs, and the 15 ports that appear most frequently together are selected to form a set of 16 ports. The pattern of this set is extracted (such as the half-byte pattern of "000*-ffff*"), and all port pairs containing these 16 ports are removed from the port pair set.

[0030] Further, repeat the above operations until the port pair set is empty, ultimately forming an association mapping table for subsequent unified encoding of ports and addresses.

[0031] It is clear that the association mapping table breaks the traditional pattern of separating address and port prediction, mapping the 16-bit port number (value 0-65535) to a hexadecimal value (0x0000-0xffff), which serves as an additional 4 nibbles for the IPv6 address (128 bits, i.e. 32 nibbles), forming a unified "address-port" structure of 36 nibbles, and denoted as "asset code", so that the address and port can be jointly extracted based on the same pattern.

[0032] Step 102: Using asset codes as input, construct a tree structure using density clustering to extract the distribution patterns of high-density active assets and generate high-probability active target assets.

[0033] In this embodiment, the core idea of ​​density clustering is to identify "high-density regions" in the data space as clustering cores and use low-density regions as clustering boundaries to achieve natural grouping of data with similar distribution characteristics. Combining this idea with a tree structure allows for the construction of a multi-level asset clustering system from global to local, from sparse to dense, ultimately accurately locating high-density active asset regions. Simultaneously, the above steps, through four steps—"vectorization and initialization—node splitting—pattern extraction—target asset generation"—transform disordered asset encoding into structured active patterns.

[0034] Specifically: Vectorization and initialization involve selecting non-aliased active assets from the initial scan results as seed assets. The "asset codes" of these seed assets are converted into high-dimensional vectors, forming the root node of the asset space tree. The root node corresponds to all seed assets. "Non-aliased" means excluding virtual identifiers generated by DNS resolution, proxy forwarding, etc., ensuring that asset codes correspond to real, existing network entities. The root node is the starting point of the tree structure, representing overall coverage of all seed assets. Its attributes include basic information such as the total number of asset vectors under that node and the range of asset codes covered.

[0035] Node splitting involves calculating the entropy value of each half-byte in all asset codes under each node. The lower the entropy value, the more concentrated the distribution of the half-byte and the more significant the pattern. The half-byte with the lowest entropy value is selected as the splitting dimension. Based on the different values ​​of the splitting dimension, the asset vector of the current node is assigned to the corresponding child nodes, splitting the node into multiple child nodes until the number of asset vectors under the child nodes is lower than a preset threshold (e.g., 100).

[0036] Pattern extraction involves extracting the half-byte patterns of the asset codes covered by each node to form a "high-probability pattern" that can be directly used to identify active assets. For example, the pattern corresponding to "2001:db8::1a01:0002" is "2001:db8::1a01:000*", which is the "high-probability active asset pattern".

[0037] Target asset generation: Based on the "high-probability active asset pattern" of each node, all "asset codes" that conform to the pattern are generated, which are the "target assets" to be detected.

[0038] Step 103: By embedding probe identifier, round and encoding information in the TCP sequence number field, stateless probe of the target asset is achieved. At the same time, alias detection is performed to determine whether it is an alias prefix, and the assets under it are recorded as alias assets.

[0039] In this embodiment, as Figure 4 As shown, stateless probing is achieved by embedding key information in the "sequence number field" of TCP packets. During the probing phase, the core objective is to efficiently identify the active assets corresponding to each node in the asset space tree. This requires transmitting the "probing round" and "node code" information through sequence number encoding to ensure that the receiving end can accurately associate the probing target with the nodes in the tree structure.

[0040] During the detection process, this embodiment of the invention sets a sequence number field of 32 bits. The first 4 bits are the "detection identifier" (fixed to 0), the next 4 bits are the "detection round" (1-15 cycle), and the last 24 bits are the "node code" (the unique identifier of the node corresponding to the asset space tree). The receiving end can parse out the "detection round" and "node code" by subtracting 1 from the confirmation number and sorting it in big-endian order, without having to maintain the sending status.

[0041] In the alias detection phase, this embodiment of the invention sets the first 4 bits of the sequence number field to "probe round", the next 4 bits to "alias detection identifier" (fixed to 0), and the last 24 bits to "prefix code" (a unique identifier corresponding to the / 64 prefix). By parsing this code, the receiving end can quickly count the number of responses for each prefix and determine whether it is an alias prefix.

[0042] It should be noted that, in the alias detection stage, this embodiment of the invention uses three core observations as a basis to perform a three-step detection process: prefix extraction and grouping, random probe generation, and TCP SYN detection. Figure 3 As shown.

[0043] Specifically, the observations are as follows: Observation 1: All addresses under the same alias prefix have completely identical open port states (because all addresses are mapped to the same physical device, the port states of the device are fixed); Observation 2: Some alias prefixes have scan rate limits. When the number of single probe packets exceeds the threshold (usually tens to hundreds of pps), the packets will be dropped, but when the number of packets is 16, they can respond completely; Observation 3: Some alias prefixes do not respond to ICMPv6 probes, but can respond to TCPSYN probes.

[0044] The specific steps of prefix extraction and grouping, random probe generation, and TCP SYN detection are as follows: (1) Prefix extraction and grouping: For the detected active assets, extract the / 64 prefix of their IPv6 address (the first 64 bits of the IPv6 address are the subnet identifier, and the same / 64 prefix usually corresponds to the same subnet), and group all active assets with the same / 64 prefix into one group.

[0045] (2) Random detection generation: For each / 64 prefix, 16 different IPv6 addresses are randomly generated by modifying the last 64 bits of the address (interface identifier part). Each address is paired with one randomly open port observed under the prefix to form 16 "assets to be detected".

[0046] (3) TCP SYN scanning and judgment: TCP SYN probe packets are sent to 16 “assets to be detected”. If more than 10 probe responses are received (response rate exceeds 62.5%), the / 64 prefix is ​​judged to be an “alias prefix” and all assets under it are “alias assets”.

[0047] It is clear that the advantage of stateless TCP scanning is that it does not require maintaining the state of data packets, reducing memory usage and computational overhead. At the same time, by distinguishing between the encoding of probes and aliases, it avoids data packet confusion, making the overall scanning speed 1.58 times to 2.01 times faster than traditional methods.

[0048] Step 104: Match the newly detected active assets with the alias prefix list. If a match is found, filter the assets. If no match is found, identify the assets as aliases and add their / 64 prefix to the alias prefix list. Update the list and dynamically iterate the detection based on the node reward value to achieve efficient discovery of IPv6 assets.

[0049] In this embodiment, an "alias prefix list" is maintained. For newly detected active assets, the / 64 prefix of the new asset's IPv6 address is extracted and first matched against the list. If a match is found, the asset is directly filtered. Active assets that do not match are detected through the above steps. If they are determined to be alias assets, their / 64 prefix is ​​added to the "alias prefix list" to ensure that subsequent probes will not allocate resources for that prefix.

[0050] Furthermore, the activity status of network assets is dynamic, and static detection strategies will lead to resource waste. By introducing the Thompson Sampling algorithm, the priority of asset spatial tree nodes can be dynamically adjusted according to real-time detection results, so that the detection direction always points to the "high probability active area".

[0051] It is clear that the "node reward value" is defined as (the number of non-aliased active assets detected under this node mode) / (the total number of asset codes covered by this node mode). After each detection, the reward value of each node is updated. In the next round of detection, the node with the highest reward value is selected first, and the target asset is generated based on its mode to ensure that detection resources are tilted towards high-probability active areas and reduce invalid detections.

[0052] Furthermore, the numerator focuses on "non-aliased active assets" to eliminate interference from aliased assets and ensure that the statistics represent the number of real and valid active assets; the denominator reflects the coverage of the node pattern (e.g., the pattern "2001:db8::1a01:000*" covers 16 asset codes), avoiding "artificially high rewards" due to excessive coverage; the higher the reward value, the greater the probability that "randomly selecting an asset code can detect a real active asset" under the node pattern, making it the preferred target for resource investment.

[0053] By using a precise filtering system based on an "alias prefix list," the problem of "invalid asset interference" in traditional scanning is solved. Furthermore, the dynamic feedback from Thompson sampling enables intelligent allocation of detection resources. Together, these two technologies construct an adaptive detection system that can both identify and avoid low-value areas (alias prefixes) and track high-value areas (high-reward nodes) in real time. This ultimately achieves a qualitative leap from "blind, wide-net scanning" to "targeted, precise intelligent detection," providing an efficient and reliable technical solution for asset identification in large-scale IPv6 networks.

[0054] The method proposed in this invention enables joint prediction of "address-port", improves detection efficiency and hit rate, fills the blind spot of ICMP-Inactive asset detection, eliminates interference from alias assets, and builds a highly available IPv6 asset hit list to support subsequent network research and application.

[0055] Experimental verification has shown that the method proposed in this embodiment of the invention has the following technical effects: Detection efficiency is significantly improved: such as Figure 5 As shown, the method proposed in this invention achieves a hit rate of 19.46% to 25.17% for non-aliased active assets, which is 82% to 214% higher than existing two-stage methods (such as 6Scan+PMap and AddrS+PMap), and the detection speed is improved by 1.58× to 2.01×. This significantly reduces the detection resource and time costs of large-scale IPv6 networks. In the figure, 6Asse is the abbreviation for a unified address and port mapping method for efficient discovery of IPv6 assets proposed in this embodiment of the invention.

[0056] Complete the blind spot of ICMP-Inactive asset detection: It can detect ICMP-Inactive assets (assets that only respond to TCP SYN and do not respond to ICMPv6) that are missed by traditional methods. These assets account for 28.22% to 60.41% of the total detected non-aliased active assets, thus achieving comprehensive asset discovery. Aliased asset interference elimination: Through the CAPD module, the proportion of aliased assets (ARate) is controlled below 0.31%, which is far lower than existing methods (usually exceeding 1%), ensuring that the detection results truly reflect the distribution of physical devices and avoiding resource waste; Building a high-availability asset list: Through large-scale probing, a hit list containing 306.2M IPv6 assets can be generated, including 117.5M ICMP-Inactive assets, covering 54,577 BGP prefixes and 19,356 ASs. All assets in the list contain open ports, and their availability is significantly higher than that of existing hit lists, which can directly support upper-layer network research and security analysis. Figure 6The details of the asset list are displayed.

[0057] To achieve the above embodiments, the present invention also proposes an efficient IPv6 asset discovery system with unified address and port mapping. Figure 7 This is a schematic diagram illustrating the structure of an efficient IPv6 asset discovery system with unified address and port mapping, provided as an embodiment of the present invention. Figure 7 As shown, the system includes: The association mapping table module 100 filters stable and active IPv6 addresses and counts open ports, generates port pairs, repeatedly extracts port set patterns and removes related port pairs to form an association mapping table, realizes unified encoding of addresses and ports, and records them as asset codes; The Asset Spatial Tree Module 200 takes asset codes as input, uses density clustering to construct a tree structure, extracts the distribution patterns of high-density active assets, and generates high-probability active target assets. The stateless TCP scanning optimization module 300 achieves stateless detection of target assets by embedding probe identifiers, rounds, and encoding information in the TCP sequence number field. At the same time, it performs alias detection to determine whether it is an alias prefix, and assets under it are recorded as alias assets. The list update and dynamic feedback module 400 matches newly detected active assets with the alias prefix list. If a match is found, the asset is filtered; otherwise, it is determined to be an alias asset, its / 64 prefix is ​​added to the alias prefix list, the list is updated, and the detection is dynamically iterated in combination with the node reward value.

[0058] Regarding the system in the above embodiments, the specific manner in which each module performs its operations has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0059] To implement the above embodiments, the present invention also proposes an electronic device, comprising: a processor, and a memory communicatively connected to the processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to implement the method provided in the foregoing embodiments.

[0060] To implement the above embodiments, the present invention also proposes a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the methods provided in the foregoing embodiments.

[0061] To implement the above embodiments, the present invention also proposes a computer program product, including a computer program that, when executed by a processor, implements the methods provided in the foregoing embodiments.

[0062] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in this invention all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0063] It should be noted that personal information collected from users should be used for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. Furthermore, such collection / sharing should only be conducted after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign an agreement / authorization that includes authorization of relevant user information before the user uses the function. In addition, any necessary steps must be taken to protect and safeguard access to such personal information data and ensure that others with access to personal information data comply with their privacy policies and procedures.

[0064] This invention is intended to provide implementation schemes for users to selectively prevent the use or access to personal information data. That is, this disclosure is intended to provide hardware and / or software to prevent or block access to such personal information data. Once personal information data is no longer needed, risks can be minimized by restricting data collection and deleting data. Furthermore, where applicable, such personal information can be de-identified to protect user privacy.

[0065] In the foregoing descriptions of the embodiments, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0066] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0067] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of the invention pertain.

[0068] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0069] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any of the following techniques known in the art, or a combination thereof: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0070] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0071] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0072] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present invention.

[0073] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0074] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for efficient discovery of IPv6 assets with unified address and port mapping, characterized in that, Includes the following steps: Filter stable and active IPv6 addresses and count open ports, generate port pairs, repeatedly extract port set patterns and remove related port pairs to form an association mapping table, realize unified encoding of addresses and ports, and record it as asset code; Using asset codes as input, a tree structure is constructed using density clustering to extract the distribution patterns of high-density active assets and generate high-probability active target assets. By embedding probe identifiers, rounds, and encoding information in the TCP sequence number field, stateless probes of target assets are achieved. At the same time, alias detection is performed to determine whether it is an alias prefix, and assets under it are recorded as alias assets. The newly detected active assets are matched with the alias prefix list. If a match is found, the assets are filtered out. If no match is found, the assets are identified as alias assets, their / 64 prefix is ​​added to the alias prefix list, the list is updated, and the detection is dynamically iterated in combination with node reward values ​​to achieve efficient discovery of IPv6 assets.

2. The method according to claim 1, characterized in that, The process involves filtering stable and active IPv6 addresses and counting open ports to generate port pairs. Port set patterns are repeatedly extracted and related port pairs are removed to form an association mapping table. This achieves a unified encoding of addresses and ports, which is then recorded as an asset code. Other components include: Filter stable and active addresses from the existing list of active IPv6 addresses, scan and count the open ports of each address; For each address's open port, generate all port pairs, defining them as symbiotic port pairs; for ports not appearing in the open ports, generate self-looping port pairs to ensure that all ports from 0 to 65535 are covered. Filter the ports that appear most frequently from all port pairs, select the 15 ports that appear most often together with them, form a set of 16 ports, extract the pattern of this set, and remove all port pairs that contain these 16 ports from the port pair set; Repeat the above operation until the port pair set is empty, and finally form an association mapping table for subsequent unified encoding of ports and addresses.

3. The method according to claim 2, characterized in that, Using asset codes as input, a tree structure is constructed using density clustering to extract the distribution patterns of high-density active assets, generating high-probability active target assets. This also includes: The asset codes of seed assets are converted into high-dimensional vectors to construct the root node of the asset space tree, which corresponds to all seed assets. Calculate the entropy value of each half-byte in all asset codes under each node, select the half-byte with the lowest entropy value as the splitting dimension, and split the node into multiple child nodes until the number of asset vectors under the child nodes is lower than a preset threshold. For each node, extract the half-byte pattern of the asset codes it covers; this pattern is the high-probability active asset pattern. Based on the high-probability active asset patterns of each node, all asset codes that conform to the pattern are generated, which are the target assets to be detected.

4. The method according to claim 3, characterized in that, Embedding probe identifiers, round numbers, and encoding information in the TCP sequence number field enables stateless probing of target assets, and also includes: The sequence number field is set to a total of 32 bits. The first 4 bits are the probe identifier, the next 4 bits are the probe round, and the last 24 bits are the node code, which is the unique identifier of the node in the corresponding asset space tree. The receiving end can parse the probe round and node code by decrementing the acknowledgment number by 1 and sorting it in big-endian order, without needing to maintain the transmission status.

5. The method according to claim 4, characterized in that, Simultaneously, alias detection is performed to determine whether it is an alias prefix; assets under such prefixes are recorded as alias assets, including: For detected active assets, extract the / 64 prefix of their IPv6 address and group all active assets with the same / 64 prefix together; For each / 64 prefix, 16 different IPv6 addresses are randomly generated by modifying the last 64 bits of the address. Each address is paired with one randomly observed open port under that prefix to form 16 assets to be detected. TCP SYN probe packets are sent to 16 assets to be tested. If more than 10 probe responses are received, the / 64 prefix is ​​determined to be an alias prefix, and all assets under it are alias assets.

6. The method according to claim 5, characterized in that, In addition to dynamic iterative probing based on node reward values, it also includes: The Thompson sampling algorithm is introduced, and a node reward value is defined. After each probe, the reward value of each node is updated. The next round of probe prioritizes the node with the highest reward value and generates target assets based on its pattern, ensuring that probe resources are tilted towards high-probability active areas and reducing invalid probes.

7. A unified address and port mapping system for efficient IPv6 asset discovery, characterized in that, include: The association mapping table module filters stable and active IPv6 addresses and counts open ports, generates port pairs, repeatedly extracts port set patterns and removes related port pairs to form an association mapping table, realizes unified encoding of addresses and ports, and records them as asset codes; The asset spatial tree module takes asset codes as input, uses density clustering to construct a tree structure, extracts the distribution patterns of high-density active assets, and generates high-probability active target assets. The stateless TCP scanning optimization module achieves stateless detection of target assets by embedding probe identifiers, rounds, and encoding information in the TCP sequence number field. At the same time, it performs alias detection to determine whether it is an alias prefix, and assets under it are recorded as alias assets. The list update and dynamic feedback module matches newly detected active assets with the alias prefix list. If a match is found, the asset is filtered; otherwise, it is determined to be an alias asset, its / 64 prefix is ​​added to the alias prefix list, the list is updated, and the detection is dynamically iterated in combination with the node reward value.

8. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-6.

10. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1-6.

Images