A Deep Learning-Based Method for Predicting Active IPv6 Addresses

Abstract

This invention belongs to the field of neural network and IPv6 address prediction technology, and specifically relates to a deep learning-based method for predicting active IPv6 addresses. By analyzing the IPv6 address structure and allocation methods, and combining existing traditional language models and target generation algorithms, this invention proposes a deep learning-based algorithm, 6LMNS, to predict potential active IPv6 addresses. 6LMNS includes an address vector space mapping model, Add2vec, and a language training model, GPT-IPv6, while introducing core sampling to replace traditional greedy search decoding. Verification shows that, compared with other target generation algorithms, 6LMNS generates addresses with better diversity and a higher activity rate.

Description

Technical Field

[0001] This invention belongs to the field of neural network and IPv6 address prediction technology, and in particular relates to an active IPv6 address prediction method based on deep learning. Background Technology

[0002] IPv6 has become the foundation supporting the future development of the Industrial Internet and the Internet of Things, with large-scale IPv6 network deployments constantly emerging. IPv6's vast address space... [1] This enables the tracking and tracing of user behavior and fine-grained network control. Researchers are exploring global IPv6 addresses to enhance their ability to conduct large-scale assessments of the next-generation Internet. While rapid advancements in networks and hardware, along with the emergence of scanning tools like Zmap and Masscan, have made it possible to explore the global IPv4 address space, IPv6 has a much larger address space, making traditional scanning methods inadequate. Therefore, achieving global IPv6 address scanning remains a challenge for researchers.

[0003] Current research on IPv6 address scanning focuses on two main aspects: First, mining the structural characteristics of known IPv6 addresses to analyze potential distribution patterns and infer clustering regions. Second, designing address generation algorithms to predict potential IPv6 addresses in the network. These predicted addresses are then used as scanning targets to achieve the goal of IPv6 address scanning.

[0004] Because IPv6 consists entirely of characters and lacks semantic information, sequence relationships cannot predict active IPv6 addresses. Although various complex algorithms have been designed, the following properties of IPv6 networks pose challenges to these algorithms:

[0005] (1) IPv6 addressing mode

[0006] Network administrators can freely choose IPv6 address allocation schemes, implementing various allocation modes for Interface Identifiers (IIDs) in addresses. Clients can use stateless addresses for autoconfiguration, generating pseudo-random or EUI-64 IIDs. Servers and routers, however, typically allocate addresses based on administrator preferences or using DHCPv6. As required by RFC 7136, these modes are opaque, making algorithmic inference difficult.

[0007] (2) IPv6 aliases

[0008] Existing experience shows that large-scale aliasing is a problem that must be addressed in future IPv6 scans because these addresses respond to queries unconditionally and are not constrained by device uniqueness. Existing algorithms still need to learn aliasing, resulting in significant computational costs for generating low-quality addresses. Summary of the Invention

[0009] To address the aforementioned problems, this invention proposes using language models and target generation algorithms to predict potential active IPv6 addresses. Based on deep learning, this invention first constructs an IPv6 vector space with certain semantic relationships through word vector space mapping; then, it uses graph neural networks to build a language model to estimate the probability distribution of word sequences and infer the composition of active addresses.

[0010] The technical solution of this invention is as follows:

[0011] A deep learning-based method for predicting active IPv6 addresses includes the following steps:

[0012] S1. Construct an IPv6 address word sequence, specifically: use address words to represent each nybble in a hexadecimal IPv6 address, and define the value of the i-th nybble in the IPv6 address as V. i Define index i as S i If i is a positive integer and 1 ≤ i ≤ 32, then the i-th address word is represented as V. i S i This allows each nybble value at a given location to be assigned a unique semantic meaning in the address term. By converting each nybble value of the entire IPv6 address into an address term, a word sequence of an IPv6 address is formed.

[0013] S2. Process all obtained IPv6 address sets using the method in S1, construct a vocabulary based on all obtained word sequences, and construct training data based on the vocabulary. Specifically, select an address word V from a word sequence. i S i As the input word, V i S i The address words before and after the target address are used as background words to generate training samples. The range of background words selected is V. i S i Centered on a window with a size of 5, i.e., using V i-2 S i-2 V i-1 S i-1 V i+1 S i+1 V i+2 S i+2 As background word V i± n S i±n The obtained training sample pairs are (V) i S i V i-2 S i-2 (V) i S i V i-1S i-1 (V) i S i , V i+1 S i+1 (V) i S i , V i+2 S i+2 Furthermore, when the address word used as the background word does not exist, the corresponding combination is empty; training data is constructed from all word sequences in the vocabulary to obtain the training dataset;

[0014] S3. Using the Word2Vec algorithm, V i S i As input, the background word V i±n S i±n The training is performed as the expected output, and word vectors are output; specifically: for each training sample pair (V) i S i , V i±n S i±n ), enter V i S i The input is fed into a two-layer neural network, which outputs the probability of each word in the vocabulary obtained in S1. Background words are then used as labels, and the network is trained using the LogSoftmax loss function. Each row of the parameter matrix of the hidden layer of the two-layer neural network is U. i With each word V in the vocabulary list i S i There is a one-to-one correspondence. After the algorithm converges, the parameter matrix of the hidden layer will be output as the word vector encoding matrix of the IPV6 address words. The word vector encoding matrix is ​​denoted as U.

[0015] S4. Use the GPT algorithm for training, and construct the address word sequence {V} from the 16-bit prefix of each sample in the real IPv6 address dataset according to the method in S1. i S i Using} as input, the word vector matrix U obtained in S3 is then used to encode the input seed set into word vectors, resulting in the input address word vector sequence {U}. i The remaining 16 suffixes are used in the same way to obtain the target address word vector sequence {U}. i '}, will {U i Input GPT network prediction {U i To improve the IPv6 address word prediction capability of GPT networks;

[0016] S5. Generate a new address: The {U} obtained in S4... iIn the converged GPT network, a sampling probability distribution is generated based on cosine similarity. Through the core sampling decoding strategy, the words output by the GPT network are recombined with the words input to generate a new address, thereby completing the prediction of active IPv6 addresses.

[0017] The beneficial effects of this invention are: compared with other target generation methods, the addresses generated by this invention have better diversity and higher activity rate. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of an IPv6 address sample.

[0019] Figure 2 This is a schematic diagram of the overall structure of Add2Vec.

[0020] Figure 3 This is a schematic diagram of the overall structure of GPT-IPv6.

[0021] Figure 4 This is a comparison chart of the probability of generating address terms by Greedy search and Nucleus Sampling.

[0022] Figure 5 This is a schematic diagram of the address prediction results at different softmax temperatures t. Detailed Implementation

[0023] The present invention will now be described in detail with reference to the accompanying drawings.

[0024] Since its inception, the IPv6 protocol standard has seen continuous evolution in its address architecture and format, with new allocation methods constantly emerging. RFC 4291 defines the basic address architecture: an IPv6 address consists of 128 bits of binary data, including a global network identifier, a subnet prefix, and an interface identifier. For example... Figure 1 As shown, the address is divided into 8 groups, each containing 4 hexadecimal digits separated by colons. Each hexadecimal digit is called a nybble. IPv6 addresses typically use :: to represent consecutive groups of zero values ​​and omit the first zero value in each group.

[0025] However, IPv6 addresses are not simply composed of meaningless numbers. IPv6 has many different addressing schemes, the interface identifier semantics are opaque, and administrators can choose to use various standards to customize address types. Furthermore, some IPv6 addresses have the SLAAC address format, the 64-bit IID is typically embedded with the MAC address according to the EUI-64 standard, or it may use pseudo-randomness entirely. (Reference) Figure 1The sample addresses in the sample, in ascending order of complexity, are: (1) an address with a fixed IID value (::3); (2) an address with a structured value in the lower 64 bits (a subnet distinguished by:a); (3) a SLAAC address with EUI-64, based on the Ethernet-MAC ID (ff:fe flag); and (4) a SLAAC privacy address with pseudo-randomness.

[0026] Because IPv6 address semantics are opaque and multiple addressing schemes exist, effective model training is difficult. To achieve an efficient address generation algorithm, it is crucial to rationally mine the semantic information of address combinations. Therefore, IPv6 semantics are generated by constructing address word sequences. By learning the context of the address word sequence model, semantically discriminative address vectors are generated, and then active addresses are inferred through language modeling.

[0027] This invention designs a deep learning-based active address generation algorithm, 6LMNS, which includes two mechanisms: Add2vec and GPT-IPv6. Add2vec maps the entire active address space to a semantic vector space, with addresses of similar sequences belonging to the same cluster. GPT-IPv6 learns semantic vectors to achieve IPv6 language modeling, comprehensively considering the relationships between multiple address sequences, and generates sequences with semantic similarity to the address set through core sampling and Top P decoding.

[0028] Add2Vec is based on the Word2vec concept, a word embedding method proposed by Google's Mikolov in 2013. To construct effective semantic information, the IPv6 address must first be assigned new semantics. For example... Figure 2 As shown, first, address terms are created to represent each nybble in a hexadecimal address. The value of the i-th nybble in the address is V. i Where V∈{0,1,...,f}. Index i is defined as S i Where S∈{0,1,...,v}. In the new representation, the i-th address word consists of a nybble value and an index value, denoted as V. i S i (For example, the 11th nybble value 4 is represented as address word 4a). The vocabulary is a sequence of address words built through the IPv6 address set. Its purpose is to distinguish nybble values ​​at different indices. The same nybble value may have different semantics depending on its position in the address.

[0029] After determining the address words, following the word selection process of Mikolov et al., input words and their contexts are selected to generate training samples. For example... Figure 2As shown, a word selection operation is performed on the input sequence. When a word in the sequence is selected as the input word, the words in the context of the input word are selected as the background words for building the training samples. The window size is 5.

[0030] Since words cannot be directly input into the neural network, each address word is represented as a One-Hot vector, the length of which is equal to the size of the vocabulary. The number of input and output neurons in the neural network equals the vocabulary size. Words are input into the neural network to attempt to predict the probability of context words. The output layer uses a softmax classifier to represent the probability of a specific word appearing in a specific context. After training, the final hidden layer result is a vector representation of the input words. In this invention, Add2Vec uses 100 neurons in the hidden layer.

[0031] The GPT-IPv6 model is trained using language, and IPv6 addresses are generated using address vectors. The overall structure of GPT is as follows: Figure 3 As shown, it uses a Transformer extractor, which has a stronger feature extraction capability than RNNs. It also improves upon the Transformer by retaining only Mask Multi-Head Attention. When performing self-attention calculations, GPT masks information from all words to the right of the current calculation position, using only the context preceding the word for prediction.

[0032] The language model computes the sequence t by decomposing the joint probability as follows: 0:L The probability distribution of L, where L is the sequence length:

[0033]

[0034] conditional probability Model and train a GPT network to process address word sequences t 0:i-1 The structure of GPT-IPv6 is as follows: Figure 3 As shown, the input words are derived from addresses in the address set. The vectors of the first 16 address words in the sequence are determined by the pre-trained Add2Vec and are input into the model to predict the next 16 words. The GPT training process consists of two parts: unsupervised pre-training of the language model and supervised downstream fine-tuning.

[0035] Given an address set U = {u1,...,u...} n}, using the standard language modeling objective, maximize the following likelihood function:

[0036]

[0037] According to We and W p To calculate the model input

[0038] h0=UW e +W p

[0039] Pass the input into the Decoder module:

[0040]

[0041] The final output h n The corresponding label probability distribution is obtained by passing the softmax function into the input:

[0042]

[0043] Among them, U=(u -k ,...,u -1 ) represents the address word vector, Θ represents the model parameters, n represents the number of network layers, and W represents the network layer number. e It is an address word embedding matrix, W p It is a position embedding matrix.

[0044] After pre-training, the model parameters are fine-tuned using a supervised objective task. Assume a labeled address set C, and that each data point is a sequence of address words x. 1 ,...,x m And the corresponding label y, and obtain the output vector h through the previously pre-trained model. l m is then fed into a linear output layer to predict the label y.

[0045]

[0046] W y To predict the parameters of the output, the loss function is:

[0047]

[0048] Finally, the objective functions of the two stages are summed using the hyperparameter λ to train the entire model:

[0049] L3(c) = L2(c) + λ*L1(c)

[0050] To complete the address generation task in the vector space, we hope to generate word vectors y. pred With the target word vector y true It exhibits high semantic similarity. Therefore, the 6LMNS model proposed in this invention uses cosine distance as the loss function L:

[0051]

[0052] L = 1 - cos(θ)

[0053] Unlike traditional language models that directly model the probability of a single word, 6LMNS predicts word vectors while preserving semantic information within the vector space. Since the training samples are semantically related address vectors obtained through the Add2Vec model, minimizing the cosine distance function ensures that the predicted target has a similar contextual structure to the address set. This method aims to select the closest address words in the vector space, which helps in discovering active IPv6 address sets.

[0054] After generating address word vectors in each epoch, the predicted word vectors and the cosine similarity of each word vector containing the current index in the vocabulary are calculated. The cosine similarity cos(θ) is converted into the word sampling probability p(i) using the softmax function:

[0055]

[0056] Where C is the number of words in the vocabulary with the current index. To obtain addresses with higher activity rates, a top-p sampling random decoding strategy is adopted, which is an improvement on the greedy strategy. In top-p sampling, the core idea is to dynamically determine the word space to be sampled based on the probability distribution, given the probability distribution at time i: P(x|x...). 1:i-1 V is the normalized probability calculated using softmax, representing the selection probability of each word at time i. Words whose sum of probabilities exceeds a fixed threshold p are selected as the top-p sampling space. (p) :

[0057]

[0058] Let p' = ∑ x∈V(k) P(x|x 1:i-1 Then, the sampling probability is renormalized:

[0059]

[0060] This strategy ensures that the words with the highest probability are selected, and their cumulative probability density is greater than a preset threshold p.

[0061] To verify the effectiveness of the present invention, the method of the present invention was tested and compared with conventional technical methods:

[0062] Test results are as follows Figure 4As shown, it can be observed that the probability of each address term generated by Top P Sampling is generally greater than that of traditional Greedy Search. Therefore, the overall activity rate of the addresses generated by this invention will be better than that of traditional Greedy Search.

[0063] In the 6LMNS model, softmax temperature is a key parameter that controls the quality of the addresses generated. When a high temperature (t) is chosen, the model tends to use random sampling, resulting in more diverse generated addresses. 6LMNS employs an improved core sampling Top P, which, while maintaining a low temperature (t), generates addresses that more closely resemble the original address set. Figure 5 The results show the address generation at different temperatures (t), with increasing temperature leading to greater diversity in the generated addresses. By testing the generation performance at different t values, it was found that when t = 0.01, the model generated addresses with a higher activity rate (r). hit and effective generation rate r gen .

Claims

1. A method for predicting active IPv6 addresses based on deep learning, characterized in that, Includes the following steps: S1. Construct an IPv6 address word sequence, specifically: use address words to represent each nybble in a hexadecimal IPv6 address, and define the value of the i-th nybble in the IPv6 address as V. i Define index i as S i If i is a positive integer and 1 ≤ i ≤ 32, then the i-th address word is represented as V. i S i This allows each nybble value at a given location to be assigned a unique semantic meaning in the address term. By converting each nybble value of the entire IPv6 address into an address term, a word sequence of an IPv6 address is formed. S2. Process all obtained IPv6 address sets using the method in S1, construct a vocabulary based on all obtained word sequences, and construct training data based on the vocabulary. Specifically, select an address word V from a word sequence. i S i As the input word, V i S i The address words before and after the target address are used as background words to generate training samples. The range of background words selected is V. i S i Centered on a window with a size of 5, i.e., using V i-2 S i-2 V i-1 S i-1 V i+1 S i+1 V i+2 S i+2 As background word V i±n S i±n The obtained training sample pairs are (V) i S i V i-2 S i-2 (V) i S i V i-1 S i-1 (V) i S i V i+1 S i+1 (V) i S i V i+2 S i+2 Furthermore, when the address word used as the background word does not exist, the corresponding combination is empty; training data is constructed from all word sequences in the vocabulary to obtain the training dataset; S3. Using the Word2Vec algorithm, V i S i As input, the background word V i±n S i±n The training is performed as the expected output, and word vectors are output; specifically: for each training sample pair (V) i S i , V i±n S i±n ), enter V i S i The input is fed into a two-layer neural network, which outputs the probability of each word in the vocabulary obtained in S1. Background words are then used as labels, and the network is trained using the LogSoftmax loss function. Each row of the parameter matrix of the hidden layer of the two-layer neural network is U. i With each word V in the vocabulary list i S i There is a one-to-one correspondence. After the algorithm converges, the parameter matrix of the hidden layer will be output as the word vector encoding matrix of the IPV6 address words. The word vector encoding matrix is ​​denoted as U. S4. Use the GPT algorithm for training, and construct the address word sequence {V} from the 16-bit prefix of each sample in the real IPv6 address dataset according to the method in S1. i S i Using} as input, the word vector matrix U obtained in S3 is then used to encode the input seed set into word vectors, resulting in the input address word vector sequence {U}. i The remaining 16 suffixes are used in the same way to obtain the target address word vector sequence {U}. i '}, will {U i Input GPT network prediction {U i To improve the IPv6 address word prediction capability of GPT networks; S5. Generate a new address: The {U} obtained in S4... i In the converged GPT network, a sampling probability distribution is generated based on cosine similarity. Through the core sampling decoding strategy, the words output by the GPT network are recombined with the words input to generate a new address, thereby completing the prediction of active IPv6 addresses.

Images