A large-scale IPv6 address liveness detection method for the Internet of Things

Abstract

The present invention relates to the technical field of Internet of Things, and in particular to a large-scale IPv6 address survival detection method for the Internet of Things. The method comprises the following steps: S1, classifying IPv6 address types; S2, merging and cleaning an initial address set to be detected; S3, then classifying the address set to be detected into corresponding address types using a target classification algorithm; and S4, adaptively selecting a detection means to perform survival detection on the IPv6 addresses in the address subset according to a scheduling strategy for different address types into which the address set to be detected is divided. The present invention proposes a fusion detection method based on address type adaptation, which firstly merges and cleans the initial address set to be detected, then classifies the address set to be detected using a target classification algorithm, and then adaptively selects a detection means to perform survival detection on the IPv6 addresses in the address subset according to a scheduling strategy for different address subsets, thereby improving the overall efficiency of survival detection for large-scale IPv6 addresses.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet of Things, and in particular to a large-scale IPv6 address survivability detection method for the Internet of Things. Background Art

[0002] IPv6 (Internet Protocol Version 6) is the next-generation IP protocol designed by the Internet Engineering Task Force (IETF) to replace IPv4. Due to its huge network carrying capacity, secure and efficient network transmission, and greater room for innovation, it has become a globally recognized next-generation Internet business application solution. The Internet of Things is a technology that combines information tools and networked sensors. It supports the interconnection of all things and has been widely used in smart transportation, smart grids, smart water services and other fields. With the continuous improvement of global information technology and demand, the number of IoT terminals will reach tens of billions or even hundreds of billions, and the lack of IP addresses will become the biggest bottleneck to its development;

[0003] Whether in asset discovery, network diagnosis or security research, Internet scanning plays a role in basic technical support. After years of iterative advancement, the scanning technology for IPv4 network space has become very mature and efficient. For example, Masscan can complete the scanning of the specified port of the entire IPv4 address space within 6 minutes, and ZMap can achieve an exhaustive scan of the entire IPv4 address space within 45 minutes. With the rapid development of IPv6 in recent years, the current status mapping, topology discovery and security research of IPv6 networks have gradually become hot topics. Among them, the most core and basic issue is network detection. Compared with IPv4's 2 32 IPv6 has 2 128 The sheer size of the IPv6 address space makes traditional detection methods, such as exhaustive scanning of the entire network space, inadequate. Even with a 10G link, even with ZMAPv6 using the highest configuration, scanning the entire IPv6 network space would still take at least hundreds of millions of years. Therefore, research on IPv6 network scanning is urgently needed, exploring new and efficient scanning technologies suitable for IPv6 networks. This research is crucial for understanding IPv6 deployment and application, and for providing intelligence for network security monitoring and threat analysis.

[0004] Recent research has made some progress in address liveness detection (address scanning) in IPv6 environments. F. Gont et al. mined and analyzed the regular characteristics of IPv6 addresses and proposed a method to reduce the IPv6 address space to be scanned. In 2016, Foremski et al. proposed an address scanning method based on Entropy / IP, using Shannon entropy to study the structure of seed addresses and employing a Bayesian model to generate new address sets. Subsequently, in 2017, Murdock et al. proposed the density-based clustering 6Gen algorithm, which also uses seed addresses as input and clusters them to generate the most likely surviving new addresses. In 2018, Gasser et al. first identified the imbalance of seed addresses and improved the Entropy / IP method. Building on the work of 6Gen, they also proposed a new alias detection algorithm. The basic idea behind most existing methods is to analyze a large sample of IPv6 addresses, explore their distribution patterns, and construct corresponding address models. Heuristic algorithms are then used to predict and generate new IPv6 address sets, thereby reducing the size of the address space to be scanned. The purpose of such methods is only to reduce the address space, but not to improve the scanning efficiency for a given large-scale address set. In response to this technical problem, those skilled in the art urgently need to develop a large-scale IPv6 address liveness detection method for the Internet of Things. Summary of the Invention

[0005] The purpose of the present invention is to provide a large-scale IPv6 address liveness detection method for the Internet of Things to solve the problems existing in the above background technology.

[0006] To achieve the above object, the present invention provides the following technical solution: a large-scale IPv6 address liveness detection method for the Internet of Things, the detection method comprising the following steps:

[0007] S1. Classify IPv6 address types into: ①Random type address; ②EUI-64 type address; ③Special_Range type address; ④Embeded_IPv4 type address; ⑤Lowbyte type address; ⑥Embeded_Port type address;

[0008] S2. Merge and clean the initial set of addresses to be detected;

[0009] S3, then using the target classification algorithm to classify the address set to be detected into the corresponding address type in step S1;

[0010] S4. For different address types into which the address set to be detected is divided, according to the scheduling strategy, adaptively select a detection means to perform liveness detection on the IPv6 addresses in the address subset.

[0011] Preferably, the classification algorithm of step S3 is to classify IPv6 addresses using a method based on feature identification and information entropy, specifically:

[0012] I. Identify whether the IID contains pre-defined explicit features and classify it according to the adapted explicit features. If the IID contains "FFFE" characters, it is an EUI-64 type address; if most bytes of the IID are set to 0, it is a Lowbyte type address; if the IID embeds the IPv4 address of the network interface, it is an Embeded_IPv4 type address; if the IID embeds the TCP / UDP service port number of the primary service running on the node, it is an Embeded_Port type address;

[0013] II. Calculate the information entropy of the IID space and determine whether it falls within a predefined range based on the entropy value. If so, it is classified as a Special_Range type address;

[0014] III. For addresses that do not have obvious features and for which no matching pattern is found, they are classified as Random type addresses.

[0015] Preferably, the classification method of the address type in step S1 includes two methods: manual configuration and automatic configuration;

[0016] The automatic configuration method is divided into two types: stateless address automatic configuration and dynamic host configuration protocol for IPv6;

[0017] The manual configuration method specifically involves manually configuring the IPv6 address of the host when the prefix is ​​known.

[0018] Preferably, there are three detection methods in step S4, namely, detection based on ICMPv6 protocol, detection based on TCP protocol and detection based on UDP protocol;

[0019] Among them, if the address type is Embeded_IPv4 and EUI-64 type address, the detection method based on the UDP protocol is adopted; if the address type is Lowbyte, Special_Range and Random type address, the detection method based on the ICMPv6 protocol is adopted; if the address type is Embeded_Port type address, the detection method based on TCP is adopted.

[0020] Preferably, the detection method based on the ICMPv6 protocol is specifically as follows: directly sending two request messages to the target address in succession to ensure that the target can receive the message, and when the target host responds, it is determined to be an active host;

[0021] The detection method based on the TCP protocol is specifically as follows: actively sending a SYN or ACK packet to a port of the target host. As long as a reply message is received from the target host, it means that the target host is in an active state;

[0022] The UDP protocol-based detection method specifically includes: actively sending a UDP message to a port of a target host, and as long as a reply message is received from the target host, it indicates that the target host is in an active state.

[0023] Compared with the prior art, the present invention has the following beneficial effects:

[0024] The present invention proposes a fusion detection method based on address type adaptation. First, the initial address set to be detected is merged and cleaned, and then the address set to be detected is classified using a target classification algorithm. Then, for different types of address subsets, according to the scheduling strategy, the detection means are adaptively selected to perform liveness detection on the IPv6 addresses in the address subset, thereby improving the overall efficiency of liveness detection for large-scale IPv6 addresses. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0026] Figure 1 Schematic diagram of the principle of the detection method of the present invention;

[0027] Figure 2 Schematic diagram of the detection process based on ICMPv6 protocol in the present invention;

[0028] Figure 3 Schematic diagram of the detection process based on the TCP protocol in the present invention;

[0029] Figure 4 This is a schematic diagram of the detection process based on the UDP protocol in the present invention. DETAILED DESCRIPTION

[0030] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making any creative efforts shall fall within the scope of protection of the present invention.

[0031] See also Figure 1-4The present invention provides a technical solution: a large-scale IPv6 address liveness detection method for the Internet of Things, the detection method comprising the following steps:

[0032] S1. Classify IPv6 address types into: ①Random type address; ②EUI-64 type address; ③Special_Range type address; ④Embeded_IPv4 type address; ⑤Lowbyte type address; ⑥Embeded_Port type address;

[0033] S2. Merge and clean the initial set of addresses to be detected;

[0034] S3, then using the target classification algorithm to classify the address set to be detected into the corresponding address type in step S1;

[0035] S4. For different address types into which the address set to be detected is divided, according to the scheduling strategy, adaptively select a detection means to perform liveness detection on the IPv6 addresses in the address subset.

[0036] Specifically, the classification algorithm in step S3 is to classify IPv6 addresses using a method based on feature identification and information entropy, specifically:

[0037] I. Identify whether the IID contains pre-defined explicit features and classify it according to the adapted explicit features. If the IID contains "FFFE" characters, it is an EUI-64 type address; if most bytes of the IID are set to 0, it is a Lowbyte type address; if the IID embeds the IPv4 address of the network interface, it is an Embeded_IPv4 type address; if the IID embeds the TCP / UDP service port number of the primary service running on the node, it is an Embeded_Port type address;

[0038] II. Calculate the information entropy of the IID space and determine whether it falls within a predefined range based on the entropy value. If so, it is classified as a Special_Range type address;

[0039] III. For addresses that do not have obvious features and for which no matching pattern is found, they are classified as Random type addresses.

[0040] Specifically, the classification method of the address type in step S1 includes two methods: manual configuration and automatic configuration;

[0041] The automatic configuration method is divided into two types: stateless address automatic configuration and dynamic host configuration protocol for IPv6;

[0042] The manual configuration method specifically involves manually configuring the IPv6 address of the host when the prefix is ​​known.

[0043] Specifically, there are three detection methods in step S4, namely, detection based on ICMPv6 protocol, detection based on TCP protocol, and detection based on UDP protocol;

[0044] Among them, if the address type is Embeded_IPv4 and EUI-64 type address, the detection method based on the UDP protocol is adopted; if the address type is Lowbyte, Special_Range and Random type address, the detection method based on the ICMPv6 protocol is adopted; if the address type is Embeded_Port type address, the detection method based on TCP is adopted.

[0045] Specifically, the detection method based on the ICMPv6 protocol is as follows: directly sending two request messages to the target address in succession to ensure that the target can receive the message, and when the target host responds, it is determined to be an active host;

[0046] The detection method based on the TCP protocol is specifically as follows: actively sending a SYN or ACK packet to a port of the target host. As long as a reply message is received from the target host, it means that the target host is in an active state;

[0047] The UDP protocol-based detection method specifically includes: actively sending a UDP message to a port of a target host, and as long as a reply message is received from the target host, it indicates that the target host is in an active state.

[0048] Example:

[0049] A large-scale IPv6 address survivability detection method for the Internet of Things, the detection method comprising the following steps:

[0050] S1. Classify IPv6 address types into: ①Random type address; ②EUI-64 type address; ③Special_Range type address; ④Embeded_IPv4 type address; ⑤Lowbyte type address; ⑥Embeded_Port type address;

[0051] There are two ways to configure IPv6 addresses: manual and automatic. Automatic configuration can be divided into two types: Stateless Address Autoconfiguration (SLAAC) and Dynamic Host Configuration Protocol for IPv6 (usually DHCPv6). Manual configuration is to manually configure the host's IPv6 address when the prefix is ​​known;

[0052] The design goal of SLAAC is to enable hosts connected to an IPv6 network to automatically obtain a network prefix and generate a usable IPv6 address. When first connecting to a network, a host sends a Router Solicitation (RS) message via multicast to the router on the local link. The router responds with a Router Advertisement (RA) message containing network layer parameters such as its prefix. The host obtains the prefix from this message and, combined with a locally generated interface identifier (IID), generates an IPv6 address.

[0053] The traditional IID is generated by the MAC address of the host network card, which is called the EUI-64 address. For example, if the host network card MAC address is 00:1b:38:83:88:3c, the corresponding IID is 021b:38ff:fe83:883c, where the inserted ff:fe is a clear feature. In order to protect the anonymity of the host when communicating with the outside world, Microsoft proposed a privacy-preserving IID random generation method (RFC4941). As can be seen, there are two types of addresses configured through the SLACC method: EUI-64 addresses and random addresses;

[0054] DHCPv6 is a stateful address configuration protocol based on the c / s architecture. The server can not only implement strategic address allocation for the client, but also record the correspondence between the address and the client host. In the DHCPv6 service, the address obtained by the client is allocated by the server according to the pre-configured address range and policy, usually in sequence within the specified range. However, since this allocation strategy will greatly reduce the search space for address scanning, RFC5157 and RFC7707 recommend that addresses should be randomly allocated from a large-scale address pool instead. RFC7217 further proposes an algorithm that can generate addresses that do not follow any specific pattern. It can be seen that there are two types of addresses allocated through DHCPv6: specific range addresses and random addresses.

[0055] S2. Merge and clean the public data address sets provided by projects including alexa1m, umbrella, statvoo, RIPE, Rapid7, Bitnodes, etc.

[0056] S3, then using the target classification algorithm to classify the address set to be detected into the corresponding address type in step S1;

[0057] Because IPv6 addresses, when represented in hexadecimal notation, consist of 32 hexadecimal characters, they offer significant advantages in semantic expression. Statistical analysis of a large number of IPv6 addresses, particularly manually assigned ones, allows for the identification of their characteristic identifiers. For example, for EUI-64 addresses, the IID portion always contains the "FFFE" field. For Embedded_IPv4 addresses, the IID portion always contains the IPv4 address, located in the last four fields of the IPv6 address (e.g., 2001:db8::192.1.2.3). Therefore, if the values ​​of the last four fields of the IPv6 address are all less than 28, the address can be identified as Embedded_IPv4. Furthermore, while the privacy extension methods used by current operating systems vary, they all essentially rely on hashing. Due to the characteristics of hashing algorithms, the results are uniformly distributed for a large number of inputs, resulting in highly random hash values. Information entropy can be used to characterize the uncertainty, dispersion, disorder, and variability of a source. If the differences between source samples are large, the value of information entropy will be correspondingly large. Based on this, the degree of randomness and disorder of IPv6 addresses can be reflected through the calculation of information entropy using the characteristics of information entropy. Therefore, the classification algorithm in step S3 uses a method based on feature identification and information entropy to classify IPv6 addresses. Specifically, the following is the method:

[0058] I. Identify whether the IID contains pre-defined explicit features and classify it according to the adapted explicit features; if the IID contains the characters "FFFE", it is an EUI-64 type address; if most bytes of the IID are set to 0 (except the smallest byte), it is a Lowbyte type address; if the IID embeds the IPv4 address of the network interface, it is an Embeded_IPv4 type address; if the IID embeds the TCP / UDP service port number of the primary service running on the node, it is an Embeded_Port type address;

[0059] II. Calculate the information entropy of the IID space and determine whether it falls within a predefined range based on the entropy value. If so, it is classified as a Special_Range type address;

[0060] III. For addresses that do not have obvious characteristics and no matching pattern is found, they are classified as random type addresses;

[0061] S4. For different address types into which the address set to be detected is divided, according to the scheduling strategy, adaptively select a detection means to perform liveness detection on the IPv6 addresses in the address subset.

[0062] IPv6 host liveness detection is to determine whether the IPv6 address is reachable. If the IPv6 address is reachable, it means that the host is active. On the contrary, if the address is unreachable, it means that the host is inactive. Therefore, there are three detection methods: detection based on the ICMPv6 protocol, detection based on the TCP protocol, and detection based on the UDP protocol.

[0063] Among them, if the address type is Embeded_IPv4 and EUI-64 type address, the detection method based on the UDP protocol is adopted; the basic principle of the UDP detection method is to actively send a UDP message to a port of the target host. As long as a reply message is received from the target host, it means that the target host is in an active state. A common application is a detection method based on DNS. The scanning host sends a DNS request message to the target address. If the target address is alive and port 53 is open, it will reply with a DNS response message; if the address is alive but the port is not open, it will return an unreachable ICMP data packet; if the address is not alive, it will not respond to the request message;

[0064] If the address type is Lowbyte, Special_Range, or Random, the ICMPv6-based detection method is used. This method does not require a specified port and can directly send two consecutive request messages to the target address to ensure that the target can receive the message. When the target host responds, it is determined to be an active host. Due to the request / response mechanism of the ICMPv6 protocol, active hosts generally respond, so this scanning method is suitable for most scenarios.

[0065] If the address type is an Embeded_Port address, a TCP-based detection method is used. This method actively sends a SYN or ACK packet to a port on the target host. As long as a reply message is received from the target host, it means that the target host is active. For example, when an ACK packet is sent directly to the target host, if the target host is alive, a RST packet will be returned to terminate the abnormal TCP connection. A normal SYN packet can also be sent. If the target host returns a SYN / ACK or RST packet, it can also prove that the target host is alive.

[0066] The effectiveness of the method proposed in this invention can also be verified through comparative experiments. Public data sets provided by projects including alexa1m, umbrella, statvoo, RIPE, Rapid7, and Bitnodes were merged and cleaned to obtain approximately 15 million valid IPv6 addresses. 500,000 addresses were randomly selected from them as a test data set. The comparison between the method proposed in this invention and each single detection method was examined from the perspectives of detection accuracy and time overhead. The accuracy is calculated as follows:

[0067]

[0068] Where num_hitAddress() refers to the number of live addresses detected by the detection method, and n is the number of detection methods. The accuracy of the method of the present invention is 93%, which is significantly higher than that of other detection methods (the accuracy of the DNS-based detection method is 79%, the accuracy of the ICMPv6-based detection method is 76%, and the accuracy of the TCP-based detection method is 45%). In terms of time cost, although the method of the present invention requires the classification of the address set first, the overall time cost is not much different from that of other detection methods and is within an acceptable range.

[0069] The present invention proposes a fusion detection method based on address type adaptation. First, the initial address set to be detected is merged and cleaned, and then the address set to be detected is classified using a target classification algorithm. Then, for different types of address subsets, according to the scheduling strategy, the detection means are adaptively selected to perform liveness detection on the IPv6 addresses in the address subset, thereby improving the overall efficiency of liveness detection for large-scale IPv6 addresses.

[0070] In the description of the present invention, it should be understood that the terms "coaxial", "bottom", "one end", "top", "middle", "the other end", "upper", "one side", "top", "inside", "front", "center", "both ends", etc., indicating orientations or positional relationships, are orientations or positional relationships based on the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention.

[0071] In the present invention, unless otherwise clearly stipulated and limited, the terms such as "install", "set", "connect", "fix", "screw" and the like should be understood in a broad sense. Unless otherwise clearly limited, ordinary technicians in this field can understand the specific meanings of the above terms in the present invention according to specific circumstances.

[0072] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that changes may be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A large-scale IPv6 address liveness detection method for the Internet of Things, characterized by: The detection method comprises the following steps: S1. Classify IPv6 address types into: ①Random type address; ②EUI-64 type address; ③Special_Range type address; ④Embeded_IPv4 type address; ⑤Lowbyte type address; ⑥Embeded_Port type address; S2. Merge and clean the initial set of addresses to be detected; S3, then using the target classification algorithm to classify the address set to be detected into the corresponding address type in step S1; S4. Adaptively select a detection method to perform liveness detection on the IPv6 addresses in the address subset according to the scheduling strategy for the different address types into which the address set to be detected is divided. The classification algorithm in step S3 is to classify IPv6 addresses using a method based on feature identification and information entropy, specifically: I. Identify whether the IID contains pre-defined explicit features and classify it according to the adapted explicit features. If the IID contains "FFFE" characters, it is an EUI-64 type address; if most bytes of the IID are set to 0, it is a Lowbyte type address; if the IID embeds the IPv4 address of the network interface, it is an Embeded_IPv4 type address; if the IID embeds the TCP / UDP service port number of the primary service running on the node, it is an Embeded_Port type address; II. Calculate the information entropy of the IID space and determine whether it falls within a predefined range based on the entropy value. If so, it is classified as a Special_Range type address; III. For addresses that do not have obvious features and for which no matching pattern is found, they are classified as Random type addresses.

2. The method for large-scale IPv6 address liveness detection for the Internet of Things according to claim 1, wherein: The classification method of the address type in step S1 includes two methods: manual configuration and automatic configuration; The automatic configuration method is divided into two types: stateless address automatic configuration and dynamic host configuration protocol for IPv6; The manual configuration method specifically involves manually configuring the IPv6 address of the host when the prefix is ​​known.

3. The method for large-scale IPv6 address liveness detection for the Internet of Things according to claim 1, wherein: There are three detection methods in step S4, namely detection based on ICMPv6 protocol, detection based on TCP protocol and detection based on UDP protocol; Among them, if the address type is Embeded_IPv4 and EUI-64 type address, the detection method based on the UDP protocol is adopted; if the address type is Lowbyte, Special_Range and Random type address, the detection method based on the ICMPv6 protocol is adopted; if the address type is Embeded_Port type address, the detection method based on TCP is adopted.

4. The method for large-scale IPv6 address liveness detection for the Internet of Things according to claim 3, wherein: The detection method based on the ICMPv6 protocol is specifically as follows: directly sending two request messages to the target address in succession to ensure that the target can receive the message, and when the target host responds, it is determined to be an active host; The detection method based on the TCP protocol is specifically as follows: actively sending a SYN or ACK packet to a port of the target host. As long as a reply message is received from the target host, it means that the target host is in an active state; The UDP protocol-based detection method specifically includes: actively sending a UDP message to a port of a target host, and as long as a reply message is received from the target host, it indicates that the target host is in an active state.

Images