Method and apparatus for detecting credit risk based on latency of ipv6 address

Abstract

The application discloses a time-delay-based IPv6 address credit risk detection method and device, which comprises the following steps: aggregating an IPv6 address set to obtain a candidate first prefix set; performing time-delay measurement and aggregation based on a live address first prefix set obtained by detecting the candidate first prefix set, and extracting time-delay set features after the time-delay measurement and aggregation; inputting the time-delay set features into a trained IPv6 mobile network address identification model for feature identification and classification, so as to obtain a first prefix set of IPv6 mobile network addresses according to an IPv6 mobile network identification and classification result; calculating the score of each first prefix in the first prefix set based on a risk index of the credit of the first prefix of the IPv6 mobile network address, so as to obtain different credit scores, and obtaining a risk detection result of the credit of the first prefix of the IPv6 mobile network according to the credit scores. The application solves the problems of data deviation and difficulty in obtaining input data, and reduces the cost of active detection.

Description

Technical Field

[0001] This invention relates to the field of mobile network address identification technology, and in particular to a method and apparatus for detecting IPv6 address credit risk based on latency. Background Technology

[0002] With the widespread adoption of 5G and IoT technologies, IPv6 deployment is accelerating, and mobile networks are rapidly migrating to IPv6. On one hand, mobile operators are accelerating IPv6 deployment. China Telecom, China Mobile, and China Unicom have completed the IPv6 transformation of LTE networks in 30 provinces and 333 prefecture-level cities nationwide. On the other hand, the number of IPv6 users is enormous. In 2020, 80% of smartphones in the United States used IPv6 addresses; in August 2021, China had 1.305 billion (80.61%) IPv6 mobile users, and with the accelerated end-to-end transformation of LTE (Long Term Evolution) networks, the number of IPv6 users in China will continue to grow.

[0003] The end-to-end transparency of IPv6 exposes the IPv6 addresses of User Equipment (UEs) in mobile networks to the internet, posing a significant security risk. Research indicates that attackers can obtain the IPv6 addresses of UEs by brute-force scanning the IPv6 prefixes declared by the Mobile Application System (AS). When a UE's IPv6 address is exposed, devices on the internet can directly access the UE via that address, exposing it to numerous security risks. For example, the UE may suffer from network attacks targeting mobile users, such as scanning attacks, over-billing attacks, and power consumption attacks. Furthermore, due to limited security protection capabilities, UEs may also be vulnerable to traditional port-based exploit attacks. Exposed mobile IP addresses can lead to privacy breaches or direct economic losses for mobile operators and users. Scoring the risk of IPv6 address exposure to the internet (hereinafter referred to as credit assessment) is crucial for quantifying the security risks faced by mobile operators and UEs, providing timely security alerts, and mitigating potential losses. However, identifying IPv6 addresses presents challenges. Mobile networks are typically situated in hybrid network environments. Hybrid networks contain both fixed and mobile broadband users, and the IPv6 addresses of mobile broadband users and fixed broadband users are mixed together, making them difficult to distinguish. IPv6 address credit assessment presupposes IPv6 address identification. Existing mobile network identification technologies typically rely on publicly available information, passive data, or active probing data sources to identify mobile network ASs or IP addresses. These technologies suffer from drawbacks such as coarse-grained identification, reliance on user equipment to collect passive data, or high overhead associated with probing, thus limiting their applicability.

[0004] Existing mobile network identification technologies are categorized into three types based on data sources: mobile network AS identification technologies based on publicly available information, mobile network IP address identification technologies based on passively collected data, and mobile network IP address identification technologies based on active measurement. Publicly available information-based mobile network AS identification technologies extract the service characteristics of ASs from publicly available information associated with them and use classification models to categorize the service types of ASs. For example, CAIDA, based on data sources such as PeeringDB, extracts AS service type characteristics and classifies ASs into three categories, with mobile networks belonging to the "Transit / Access" category. Ziv et al. used data sources such as Whois and website homepages to classify AS service types in detail, with mobile networks belonging to the "Phone Provider" category. Passively collected data-based mobile network IP address identification technologies collect and summarize relevant data such as IP addresses and access types used by user devices through specific application programming interfaces (APIs) on the user devices, and then identify mobile network IP addresses through data analysis methods. For example, Xu et al. obtained mobile IP addresses and network access types by calling the operating system interface through mobile applications, and then used the longest matching prefix in the BPG route advertisement as the mobile network IPv4 prefix; Rula et al. obtained IP addresses and access types through the Network Information API of mobile browsers, and classified the IP prefixes according to the proportion of access types in the IP prefixes, identifying 350,000 mobile IPv4 / 24 prefixes and 23,000 mobile IPv6 / 48 prefixes. Using this technology requires large-scale deployment of specific mobile applications on a certain number of user devices or a large user base, and the collection of a certain amount of valid user data. Active measurement-based mobile network IP address identification technology identifies mobile network IP addresses based on the characteristics (such as latency) of the response data from actively probing target IP addresses.For example, Wang et al. utilized the characteristic that mobile IoT devices (cellular-IoT) in Power Save Mode (PSM) do not respond to active probes while in sleep mode. Based on whether and when the target IP address responds to active probes, they identified cellular-IoT devices with PSM mechanisms. Lee et al. used string patterns existing in reverse DNS (rDNS) to cluster IPv4 addresses. They identified mobile network IPv4 address clusters by taking advantage of the high round-trip latency of the clusters containing mobile network IPv4 addresses. Perta et al. triggered changes in the Radio Resource Controller (RRC) state of the target device through instant messaging software. At the same time, they monitored changes in the round-trip latency of the target IP address and filtered out IP addresses with RRC state changes, thereby associating mobile users with mobile network IP addresses.

[0005] The shortcomings of existing technologies are as follows: First, mobile network AS identification techniques based on publicly available data have too coarse a granularity. These techniques can only identify ASs containing mobile network IP addresses, resulting in a coarse granularity. Most mobile network ASs exist in hybrid networks, and mobile operators generally do not disclose their address allocation policies for security reasons. Therefore, publicly available data provides limited information for identifying mobile networks and cannot meet finer-grained identification needs, such as further identifying mobile network IP addresses from ASs. Second, mobile network IP address identification techniques based on passively collected data suffer from bias and are difficult to obtain. These techniques rely on input data. They typically require deploying mobile applications on a certain number of user devices to collect user data, using large volumes to ensure good statistical characteristics. Such methods have high requirements for input data quality, such as large data volumes, which are usually only met by content providers like CDNs or network service providers. For ordinary researchers, obtaining a sufficient amount of input data is difficult, limiting the applicability of this method. Meanwhile, passively collected user data is often biased due to factors such as user preferences, application deployment scale, and terminal geographic distribution (e.g., Facebook has a lower usage rate in China, while WeChat has a higher usage rate). Therefore, this type of technology cannot identify mobile network IP addresses outside the input data, and the identification results are also biased. Active measurement-based mobile network IP address identification technology incurs high active identification overhead and is sensitive to network packet loss. This technology typically requires sending multiple probe packets to the same IP address and collecting probe responses. Considering the impact of network packet loss, existing technologies usually send 10 probe packets to a single IP address. For IPv6 mobile networks with a large user base, this leads to excessive active identification overhead and may even damage the target device. Furthermore, IPv6 mobile terminal user IP addresses are rarely associated with rDNS, making it impossible for existing technologies to perform clustering based on rDNS patterns, thus hindering mobile IPv6 address identification. Summary of the Invention

[0006] The present invention aims to at least partially solve one of the technical problems in the related art.

[0007] To address the problems of coarse identification granularity, biased and difficult-to-obtain passive data, and high active identification overhead in existing technologies, this invention proposes a latency-based IPv6 address credit risk detection method. This method achieves IPv6 address identification at the IP address granularity with minimal active identification overhead, without relying on passive data collected by user equipment.

[0008] Another objective of this invention is to provide a latency-based IPv6 address credit risk detection device.

[0009] To achieve the above objectives, this invention proposes a latency-based IPv6 address credit risk detection method, comprising:

[0010] Aggregate the set of IPv6 addresses to obtain the set of candidate first prefixes;

[0011] Based on the active address first prefix set obtained by probing the candidate first prefix set, delay measurement and aggregation are performed, and the delay set features after delay measurement and aggregation are extracted;

[0012] The latency set features are input into the trained IPv6 mobile network address recognition model for feature recognition and classification, so as to obtain the first prefix set of IPv6 mobile network addresses based on the IPv6 mobile network recognition and classification results;

[0013] Based on the risk index of the first prefix credit of IPv6 mobile network addresses, a score is calculated for each first prefix in the first prefix set to obtain a different credit score, so as to obtain the risk detection result of the first prefix credit of IPv6 mobile network based on the credit score.

[0014] In addition, the latency-based IPv6 address credit risk detection method according to the above embodiments of the present invention may also have the following additional technical features:

[0015] Further, in one embodiment of the present invention, the step of performing delay measurement and aggregation on the active address first prefix set obtained by probing the candidate first prefix set, and extracting the delay set features after delay measurement and aggregation, includes:

[0016] Randomly probe each second prefix in the candidate first prefix set to obtain the active address first prefix set;

[0017] The round-trip time from each active address in the first prefix set of active addresses to the measurement point is measured using a preset protocol, and the round-trip time is aggregated according to the first prefix to obtain the first prefix delay set;

[0018] Feature extraction is performed on the first prefix delay set to obtain delay set features.

[0019] Furthermore, in one embodiment of the present invention, before inputting the latency set features into the trained IPv6 mobile network address recognition model for feature recognition and classification, the method further includes:

[0020] Obtain a set of delay samples;

[0021] The features of the time delay set are labeled according to the prefix type of the time delay set samples, so as to obtain the sample dataset based on the labeling results;

[0022] The sample dataset is divided into a training set and a test set according to a preset ratio. The machine learning model is trained using the training set and tested using the test set, so as to obtain a trained IPv6 mobile network address recognition model based on the model test results.

[0023] Furthermore, in one embodiment of the present invention, the risk indicators include a special IID pattern in the IPv6 address, actively probing the scale of active users, and passively collecting the scale of active users.

[0024] Further, in one embodiment of the present invention, the risk index based on the first prefix credit of the IPv6 mobile network address calculates a score for each first prefix in the first prefix set to obtain a different credit score, so as to obtain a risk detection result of the first prefix credit of the IPv6 mobile network based on the credit score, including:

[0025] Obtain the number of various types of IPv6 addresses; wherein, the number of various types of IPv6 addresses includes the number of IPv6 addresses under the first prefix that satisfy the special IID mode, the number of active IPv6 addresses that detect and respond to the first prefix of the preset IPv6 address, and the number of IPv6 addresses under the first prefix that are passively collected;

[0026] The credit score is obtained by calculating the number of IPv6 addresses of various types using a preset function, and a three-dimensional scoring vector is obtained based on the credit score.

[0027] Risk detection of IPv6 first prefix credit is performed based on the scoring vector, and the risk detection result is obtained by judging the magnitude of IPv6 first prefix credit risk value according to the numerical value of the scoring vector.

[0028] To achieve the above objectives, another aspect of the present invention proposes a latency-based IPv6 address credit risk detection device, comprising:

[0029] The candidate set acquisition module is used to aggregate the IPv6 address set to obtain the candidate first prefix set;

[0030] The latency detection and aggregation module is used to perform latency measurement and aggregation based on the active address first prefix set obtained by detecting the candidate first prefix set, and to extract the latency set features after latency measurement and aggregation;

[0031] The feature recognition and classification module is used to input the delay set features into the trained IPv6 address recognition model for feature recognition and classification, so as to obtain the first prefix set of IPv6 mobile network addresses based on the IPv6 mobile network recognition and classification results;

[0032] The credit scoring detection module calculates the score of each first prefix in the first prefix set based on the risk index of the first prefix credit of the IPv6 mobile network address to obtain different credit scores for the first prefix, so as to obtain the risk detection result of the first prefix credit of the IPv6 mobile network based on the credit scores.

[0033] This invention discloses a latency-based IPv6 address credit risk detection method and apparatus. Based on the characteristic that the Radio Resource Controller (RRC) in a mobile network introduces additional round-trip latency during state transitions, it utilizes active probing to trigger changes in the user equipment's RRC state and round-trip latency. This invention learns the latency characteristics of different network / 48 prefixes using machine learning algorithms to identify IPv6 / 48 prefixes and the IPv6 addresses they contain. Addressing the problem of coarse-grained identification in mobile network AS identification techniques based on publicly available data, this invention achieves IP address-level mobile network identification by identifying mobile IPv6 address prefixes. Addressing the issues of biased and difficult-to-obtain data in mobile network IP address identification techniques based on passively collected data, this invention obtains round-trip latency data of the user equipment's IPv6 address through active probing as input, without relying on specific application programming interfaces (APIs) of the user equipment for data collection, thus solving the problems of data bias and difficulty in obtaining input data. To address the issue of high active identification overhead in mobile network IP address identification technologies based on active measurement, this invention reduces the overhead of active probing by probing the IPv6 / 48 prefix and calculating the latency difference of the / 48 prefix, thereby enhancing robustness to network packet loss and improving identification efficiency. This invention does not rely on rDNS for clustering. Instead, it utilizes the homogeneity of IPv6 addresses within the IPv6 / 48 prefix in terms of address space, geographical location, and other factors to cluster IPv6 addresses.

[0034] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0035] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0036] Figure 1 This is a flowchart of a latency-based IPv6 address credit risk detection method according to an embodiment of the present invention;

[0037] Figure 2 This is a schematic diagram of the detection overhead evaluation according to an embodiment of the present invention;

[0038] Figure 3 This is a schematic diagram of network packet loss performance evaluation according to an embodiment of the present invention;

[0039] Figure 4 This is a schematic diagram of the structure of a latency-based IPv6 address credit risk detection device according to an embodiment of the present invention. Detailed Implementation

[0040] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0041] To enable those skilled in the art to better understand the present invention, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0042] The following description, with reference to the accompanying drawings, describes a latency-based IPv6 address credit risk detection method and apparatus according to embodiments of the present invention.

[0043] The terminology used in this invention is: Mobile network / cellular network: an operator network that provides wireless internet access capabilities to mobile users, fixed wireless access (FWA), machine-to-machine communication (M2M), etc., through a radio access network and a packet core network. For example, China Telecom's mobile broadband network provides cellular communication using a subscriber identification card module (SIM) for smartphones, IoT devices, etc.

[0044] User Equipment (UE) refers to user terminal equipment that uses a Subscriber Identity Module (SIM) to access a mobile network, including smartphones, 4G / 5G Customer Premise Equipment (CPE), and mobile Internet of Things (cellular-IoT) devices.

[0045] IPv6 address: refers to the IPv6 address assigned by the mobile network to the user equipment (UE). It is generally composed of a / 64 prefix dynamically assigned by the operator and an interface identifier randomly generated by the UE.

[0046] Figure 1 This is a flowchart of a latency-based IPv6 address credit risk detection method according to an embodiment of the present invention.

[0047] like Figure 1 As shown, the method includes, but is not limited to, the following steps:

[0048] S1, aggregate the set of IPv6 addresses to obtain the set of candidate first prefixes.

[0049] It is understood that, in the embodiments of the present invention, a set of candidate IPv6 addresses is obtained, and the set of candidate IPv6 addresses is aggregated to obtain a set of candidate / 48 prefixes.

[0050] Understandably, the IPv6 address space is vast and sparse. To avoid blindly probing the IPv6 address space, this invention first collects the / 48 prefixes of active addresses. Active addresses refer to IP addresses that have appeared on the Internet in the past or present, including addresses obtained through passive collection and active probing.

[0051] As some embodiments of the present invention, IPv6 address sets can be obtained through various schemes for collecting IPv6 addresses in related technologies, such as passive collection, random probing, and Hitlist, which will not be elaborated here.

[0052] Furthermore, the aforementioned active IPv6 addresses are aggregated according to their / 48 prefixes to obtain a set of candidate / 48 prefixes that may contain IPv6 addresses. Each / 48 prefix should contain at least one active IPv6 address.

[0053] S2, based on the active address first prefix set obtained from the probe candidate first prefix set, performs delay measurement and aggregation, and extracts the delay set features after delay measurement and aggregation.

[0054] As some embodiments of the present invention, each / 64 prefix in the candidate / 48 prefix set is randomly probed once to obtain the set of active IPv6 mobile network addresses; the round-trip time is measured for each active IPv6 address, and the round-trip time is aggregated according to the / 48 prefix to obtain the delay set of the / 48 prefix; the features of the delay set of the / 48 prefix are extracted.

[0055] Specifically, for the 65,536 / 64 prefixes in the candidate / 48 prefix set, a random probe is performed using ICMPv6, TCP6, or UDP6 protocols to obtain the set of active IPv6 mobile network addresses under that / 48 prefix. For each active IPv6 address, the round-trip time is measured using ICMPv6, TCP6, or UDP6 protocols. The round-trip time is aggregated according to the / 48 prefix to obtain the delay set of all active addresses under that / 48 prefix. Features are then extracted from the delay set.

[0056] The method for obtaining the active address set is as follows: This invention generates 65,536 random addresses under the / 48 prefix by concatenating a 64-bit prefix and a 64-bit interface identifier (IID). Specifically: 65,536 / 64 prefixes are generated under the / 48 prefix; for each / 64 prefix, a random 64-bit or all-zero interface identifier is concatenated to form a complete IPv6 address. A probe (denoted as packet P0) is performed on the above 65,536 random IPv6 addresses. From the error messages of the probe response, IPv6 addresses whose request and response / 64 prefixes are the same are filtered to obtain N active IPv6 addresses under the / 48 prefix.

[0057] The method for measuring the round-trip time set is as follows: A probe packet (packet P1) is sent to M (M<=N) active IPv6 addresses under the / 48 prefix to measure the round-trip time. The delay measurement results are then aggregated according to the / 48 prefix to form the delay set of the / 48 prefix. This invention eliminates the need to measure the delay of all N active IPv6 addresses; only M of them need to be measured, reducing measurement overhead. The delay measurement method is robust to network packet loss.

[0058] During the above detection process, P0 is responsible for discovering active IPv6 addresses and triggering target RRC state transitions, while P1 is responsible for measuring the round-trip time of the target, including the RRC state transition delay.

[0059] The method for extracting the features of the delay set of a / 48 prefix is ​​as follows: Let the delay set of a certain / 48 prefix be R = {T} i}, i≤65536, where i represents the i-th delay in the delay set R.

[0060] Specifically, the method for extracting the time delay features of the / 48 prefix is ​​as follows:

[0061] Calculate the variance and time delay interval range of R (maximum value minus minimum value), for a total of 2-dimensional features;

[0062] The distribution of time delay differences. Let the set of time delay differences be denoted as... Extract D R The variance, maximum value, minimum value, 95th quantile, 5th quantile, and mean are a total of 6 features;

[0063] Delay difference set D R Distribution at different percentiles. Choose D. R The time delay difference at 100 percentiles {p1,…,p 100}, calculate the difference between percentiles S = {p1-p2,…,p 99 -p 100} Calculate the variance, maximum value, minimum value, 95th quantile, 5th quantile, and mean of S, for a total of 6 features;

[0064] Delay difference set D R Distribution across different time delay intervals. Let G be... t ={-t<D R ≤t} represents D R The time delay difference between the time delay interval (-t, t] is calculated. Where g is the upper limit of the time delay difference, for example, 1000ms can be selected. Calculate the variance, maximum value, minimum value, 95th quantile, 5th quantile, and mean of G, for a total of 6 features.

[0065] S3. Input the delay set features into the trained IPv6 mobile network address recognition model for feature recognition and classification, so as to obtain the first prefix set of IPv6 mobile network addresses based on the IPv6 mobile network recognition and classification results.

[0066] Specifically, the IPv6 / 48 prefix identification model is trained and tested. A set of known mobile operator IPv6 prefix latency data is selected (the set of known mobile operator prefixes in one embodiment of the present invention is shown in Table 1), and the latency features of the / 48 prefix described in step 2 are extracted. The extracted features are labeled according to the type of the known operator prefix, with the label type being either "mobile network" or "fixed network". The dataset is divided into training and testing sets according to a certain ratio, such as 7:3, and a machine learning model (such as random forest) is used to train and test the performance of the IPv6 identification model. The model with the best performance is selected to obtain the IPv6 identification model. Thus, through the latency-based IPv6 address identification model, the features of the / 48 prefix latency set are identified and classified to obtain the IPv6 / 48 prefix set.

[0067] Table 1

[0068]

[0069] S4, based on the risk index of IPv6 mobile network address / 48 prefix credit, calculate the score of each / 48 prefix in the / 48 prefix set to obtain different credit scores, so as to obtain the risk detection result of IPv6 / 48 prefix credit based on the credit scores.

[0070] Specifically, features are extracted from the latency set of candidate / 48 prefixes, and the candidate / 48 prefixes are classified using an IPv6 address identification model to obtain an IPv6 / 48 prefix set. The IPv6 address identification model is obtained from step S3. Candidate / 48 prefixes are those other than the mobile network prefixes known in Table 1.

[0071] Furthermore, each / 48 prefix in the IPv6 / 48 prefix set is scored, and a credit score is calculated for each / 48 prefix. An IPv6 address credit score represents the risk of an IPv6 address being discovered and exposed on the Internet.

[0072] As some embodiments of the present invention, the present invention calculates the credit score of IPv6 / 48 prefix by using three factors that affect the credit of mobile network / 48 prefix:

[0073] Factor indicator 1: Special IID patterns in IPv6 addresses.

[0074] Special IID modes refer to the IID portion of the IPv6 address in the Mobile / 48 prefix that exhibits the IID modes shown in Table 2. Each row in Table 2 represents an IID mode, and the columns represent the specific value range of bytes 9 to 16 in the IPv6 address within that mode (i.e., the IID portion of the IPv6 address), expressed in hexadecimal, such as 1F representing decimal 31. "x" indicates any value within the range [0-F]. Mode 1 includes Mode 2.

[0075] The mobile network / 48 prefix is ​​identified using Mode 1. When an IP address of Mode 1 is present in the response address of an actively probed mobile / 48 prefix, the accuracy rate of identifying the prefix as a mobile network / 48 prefix is ​​98.83%. This indicates that Mode 1 can accurately identify the mobile network / 48 prefix. Therefore, the presence of a / 48 prefix of Mode 1 indicates a high exposure risk and a high credit score.

[0076] Based on the number of IPv6 addresses satisfying special IID mode 1 under the / 48 prefix, this invention uses the function a(x,t) to calculate the credit score Score1. The function a(x,t) is as follows:

[0077] Table 2

[0078] IID mode 9th 10th 11th 12th 13th 14th 15th 16th Mode 1 00 0[0-2] 00 [00-77] xx xx xx xx Mode 2 00 0[0-2] 00 [00-77] xx xx xx 01

[0079] Factor indicator 2: Proactively detect the scale of active users.

[0080] The larger the user base, the greater the probability of being randomly and actively detected, and the easier it is to be exposed on the internet, thus resulting in a higher credit score.

[0081] This invention actively probes known mobile network / 48 prefixes and calculates a credit score (Score2) using the function a(x,t) based on the number of active IPv6 addresses responding. The function a(x,t) is as follows:

[0082] Factor indicator 3: Scale of passively collected active users.

[0083] The larger the user base, the greater the likelihood that mobile IP address usage traces will be recorded on the internet. The risk of mobile network exposure is assessed based on the frequency of different mobile prefixes appearing in passive data on the internet.

[0084] Based on the number of passively collected IPv6 addresses with the / 48 prefix, the credit score Score3 is calculated using the function a(x,t). The function a(x,t) is as follows: Passive data collection can be achieved through active probing methods such as Domain Lists, FDNS, CT, Bitnodes, RIPE Atlas, and Scamper, which will not be elaborated further.

[0085] For each / 48 prefix, a three-dimensional score vector {Score1, Score2, Score3} is obtained, representing the exposure risk of the mobile network / 48 prefix in the three dimensions, respectively. The higher the calculated credit score of the mobile network / 48 prefix, the greater the exposure risk.

[0086] In summary, this invention achieves IPv6 address granularity identification solely through active probing, without relying on passive data collected from user data collection. This provides a fast, efficient, and proactive method for identifying IPv6 addresses. This invention reduces the difficulty of identification in mobile networks, has lower identification overhead compared to existing active identification technologies, and is more robust to network packet loss. The IPv6 / 48 prefix credit score can quantify the exposure risks faced by the / 48 prefix, providing risk alerts for mobile operators and mobile users, and providing data support for operators to update their security strategies.

[0087] Furthermore, this invention achieves IPv6 address identification at the IP prefix / address granularity, identifying 43,000 mobile network / 48 prefixes so far, distributed across 126 mobile network ASs, as shown in Table 3. This is nearly double the 23,000 mobile network / 48 prefixes discovered by Rula et al., demonstrating the advantages of the proactive detection proposed in this invention.

[0088] Table 3

[0089]

[0090] Therefore, the present invention has low detection overhead, high identification accuracy, and can achieve good IPv6 mobile network identification performance. Figure 2 The performance of the present invention in terms of probe overhead is demonstrated. The results show that the probe packet overhead of the present invention for a single IPv6 address is at most 2 (P0 and P1), which is smaller than the probe overhead of general methods. The measurement overhead of the method of the present invention is reduced to one-tenth of the original. Figure 2 The horizontal axis represents the number of data packets sent to a single IPv6 address, and the vertical axis represents the accuracy and recall of the / 48 prefix identification. This shows that the latency-based IPv6 identification method proposed in this invention can achieve an accuracy of 99.95% and a recall of 99.62% when the number of data packets sent to a single IPv6 address is 1 (P1).

[0091] By controlling the number of effective round-trip times to simulate network packet loss, the results show that the accuracy of the present invention is almost unaffected by network packet loss; despite the presence of network packet loss, only a small amount of effective delay (e.g., 125) is needed to achieve a high recall rate (e.g., 96.08%). Figure 3 This paper demonstrates the performance of the present invention in resisting network packet loss, where the horizontal axis represents the number of effective round-trip times obtained when network packet loss occurs in a simulated single / 48 prefix, and the vertical axis represents the accuracy and recall of the / 48 prefix identification. The results show that the accuracy of the present invention is largely unaffected by network packet loss, remaining at approximately 99.8%; when network packet loss occurs, only 125 effective delays are needed to achieve a recall rate of 96.08%; when the number of effective delays reaches 400, the recall rate reaches 97.06%, and the recall rate remains essentially unchanged as the number of effective delays increases. By artificially simulating packet loss, the measurement overhead for the / 48 prefix can be further reduced. Therefore, the measurement overhead of the present invention is reduced to at least one-tenth of that of existing methods.

[0092] The latency-based IPv6 address credit risk detection method according to embodiments of the present invention identifies mobile IPv6 address prefixes to achieve mobile network identification at the IP address granularity. It obtains round-trip latency data of user equipment IPv6 addresses through active probing as input, without relying on specific application programming interfaces of user equipment to collect data. This solves the problems of data bias and difficulty in obtaining input data, reduces the overhead of active probing, enhances robustness to network packet loss, and improves identification efficiency.

[0093] To achieve the above embodiments, such as Figure 4 As shown, this embodiment also provides a latency-based IPv6 address credit risk detection device 10, which includes a candidate set acquisition module 100, a latency detection aggregation module 200, a feature recognition and classification module 300, and a credit score detection module 400.

[0094] The candidate set acquisition module 100 is used to aggregate the IPv6 address set to obtain the candidate first prefix set;

[0095] The delay detection aggregation module 200 is used to perform delay measurement and aggregation based on the active address first prefix set obtained from the candidate first prefix set, and to extract the delay set features after delay measurement and aggregation.

[0096] The feature recognition and classification module 300 is used to input the delay set features into the trained IPv6 address recognition model for feature recognition and classification, so as to obtain the first prefix set of IPv6 mobile network addresses based on the IPv6 mobile network recognition and classification results.

[0097] The credit scoring detection module 400 calculates the score of each first prefix in the first prefix set based on the risk index of the first prefix credit of the IPv6 mobile network address to obtain different credit scores for the first prefix, so as to obtain the risk detection result of the first prefix credit of the IPv6 mobile network based on the credit scores.

[0098] Furthermore, the aforementioned delay detection aggregation module 200 is also used for:

[0099] The active address first prefix set is obtained by randomly probing each second prefix in the candidate first prefix set;

[0100] The round-trip time from each active address in the first prefix set of active addresses to the measurement point is measured using a preset protocol, and the round-trip time is aggregated according to the first prefix to obtain the first prefix delay set;

[0101] Feature extraction is performed on the first prefix delay set to obtain the delay set features.

[0102] Furthermore, prior to the aforementioned feature recognition and classification module 300, a model training module is also included, used for:

[0103] Obtain a set of delay samples;

[0104] The features of the time delay set are labeled according to the prefix type of the time delay set samples, so as to obtain the sample dataset based on the labeling results;

[0105] The sample dataset is divided into a training set and a test set according to a preset ratio. The machine learning model is trained using the training set and tested using the test set, so as to obtain a trained IPv6 mobile network address recognition model based on the model test results.

[0106] Furthermore, risk indicators include specific IID patterns in IPv6 addresses, proactive probing of active user scale, and passive collection of active user scale.

[0107] Furthermore, the aforementioned credit scoring detection module 400 is also used for:

[0108] Obtain the number of various types of IPv6 addresses; wherein, the number of various types of IPv6 addresses includes the number of IPv6 addresses under the first prefix that satisfy the special IID mode, the number of active IPv6 addresses that detect and respond to the first prefix of the preset IPv6 address, and the number of IPv6 addresses under the first prefix that are passively collected;

[0109] The credit score is obtained by calculating the number of IPv6 addresses of various types using a preset function, and a three-dimensional scoring vector is obtained based on the credit score.

[0110] Risk detection of IPv6 first prefix credit is performed based on the scoring vector, and the risk detection result is obtained by judging the magnitude of IPv6 first prefix credit risk value according to the numerical value of the scoring vector.

[0111] The latency-based IPv6 address credit risk detection device according to embodiments of the present invention achieves mobile network identification at the IP address granularity by identifying mobile IPv6 address prefixes. It obtains round-trip latency data of user equipment IPv6 addresses through active probing as input, without relying on specific application programming interfaces of user equipment to collect data. This solves the problems of data bias and difficulty in obtaining input data, reduces the overhead of active probing, enhances robustness to network packet loss, and improves identification efficiency.

[0112] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0113] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A latency-based IPv6 address credit risk detection method, characterized in that, The method comprises the following steps: aggregating IPv6 address sets to obtain a candidate first prefix set; performing time delay measurement and aggregation on the active address first prefix set obtained by probing the candidate first prefix set, and extracting time delay set features after time delay measurement and aggregation; inputting the time delay set features into a trained IPv6 mobile network address identification model for feature recognition and classification to obtain a first prefix set of IPv6 mobile network addresses according to the IPv6 mobile network identification and classification results; calculating the score of each first prefix in the first prefix set based on the risk indicators of the first prefix credit of the IPv6 mobile network address to obtain different credit scores, and obtaining the risk detection results of the first prefix credit of the IPv6 mobile network according to the credit scores.

2. The method of claim 1, wherein, The method comprises the following steps: randomly probing each second prefix in the candidate first prefix set to obtain an active address first prefix set; measuring the round-trip time of each active address in the active address first prefix set to the measurement point using a preset protocol, and aggregating the round-trip times according to the first prefix to obtain a first prefix time delay set; extracting features from the first prefix time delay set to obtain time delay set features.

3. The method of claim 1, wherein, Before the time delay set features are input into the trained IPv6 mobile network address identification model for feature recognition and classification, the method further comprises the following steps: obtaining time delay set samples; labeling the time delay set features according to the prefix type of the time delay set samples to obtain a sample data set according to the labeling results; dividing the sample data set into a training set and a test set according to a preset ratio, training a machine learning model using the training set, and testing the trained machine learning model using the test set to obtain a trained IPv6 mobile network address identification model based on the model test results.

4. The method of claim 3, wherein, The risk indicators include special IID patterns in IPv6 addresses, active user scales of active probing, and active user scales of passive collection.

5. The method of claim 4, wherein, The method comprises the following steps: obtaining a plurality of IPv6 address quantities; wherein the plurality of IPv6 address quantities include the number of IPv6 addresses that meet the special IID pattern under the first prefix, the number of active IPv6 addresses that respond to the probing of the preset IPv6 address under the first prefix, and the number of IPv6 addresses under the first prefix collected passively; calculating the credit scores using a preset function based on the plurality of IPv6 address quantities, and obtaining a three-dimensional score vector according to the credit scores. Perform risk detection on the IPv6 first prefix credit based on the score vector to obtain a risk detection result of the IPv6 first prefix credit risk value size according to the numerical size of the score vector.

6. A latency-based IPv6 address credit risk detection apparatus, characterized by, Comprise: The candidate set acquisition module is used for aggregating the IPv6 address set to obtain a candidate first prefix set. The time delay detection aggregation module is used for performing time delay measurement and aggregation based on the active address first prefix set obtained by detecting the candidate first prefix set, and extracting time delay set features after the time delay measurement and aggregation. The feature recognition and classification module is used for inputting the time delay set features into a trained IPv6 address recognition model for feature recognition and classification, so as to obtain the first prefix set of the IPv6 mobile network address according to the IPv6 mobile network recognition and classification result. The credit score detection module calculates the score of each first prefix in the first prefix set based on the risk indicators of the IPv6 mobile network address first prefix credit to obtain the credit score of different first prefixes, so as to obtain the risk detection result of the IPv6 mobile network first prefix credit according to the credit score.

7. The apparatus of claim 6, wherein, The time delay detection aggregation module is also used for: Randomly detecting each second prefix in the candidate first prefix set to obtain an active address first prefix set; Measuring the round-trip time of each active address to a measurement point in the active address first prefix set by using a preset protocol, and aggregating the round-trip times according to the first prefix to obtain a first prefix time delay set; Extracting features from the first prefix time delay set to obtain time delay set features.

8. The apparatus of claim 6, wherein, Before the feature recognition and classification module, the model training module is also used for: Obtaining time delay set samples; Labeling the time delay set features according to the prefix type of the time delay set samples to obtain a sample data set according to the label marking result; Dividing the sample data set into a training set and a test set according to a preset ratio, training a machine learning model by using the training set, and testing the trained machine learning model by using the test set to obtain a trained IPv6 mobile network address recognition model based on the model test result.

9. The apparatus of claim 6, wherein, The risk indicators include a special IID mode in the IPv6 address, an active user scale of active detection, and an active user scale of passive collection.

10. The apparatus of claim 9, wherein, The credit score detection module is also used for: Obtaining a plurality of IPv6 address quantities; wherein the plurality of IPv6 address quantities include the IPv6 address quantity of the first prefix satisfying the special IID mode, the active IPv6 address quantity of the first prefix responding to the detection of the preset IPv6 address, and the IPv6 address quantity of the first prefix collected passively; Calculating the credit score by using a preset function based on the plurality of IPv6 address quantities, and obtaining a three-dimensional score vector according to the credit score; Perform risk detection on the IPv6 first prefix credit based on the score vector to obtain a risk detection result of the IPv6 first prefix credit risk value size according to the numerical size of the score vector.

Images