A dynamic feedback type IPV6 active address generation method and system

Abstract

The application provides a dynamic feedback type IPV6 active address generation method and system, relates to the network space detection technical field, and comprises the following steps: acquiring an IPV6 address data set, classifying according to an autonomous domain, and obtaining a plurality of active address seed subsets; performing a split hierarchical clustering operation on the active address seed subsets respectively, and obtaining an address region space tree; constructing a priority queue, setting a target address generation scale, obtaining the survival degree value of each leaf node address region, allocating the address scale according to the survival degree value size, and putting into the priority queue; scanning and generating addresses according to the address scale of the address region dequeued from the priority queue; updating the survival degree value of the address region, allocating the target address generation scale of the next round, and reentering the priority queue; and repeatedly scanning the priority queue until the scanned address number reaches the target address generation scale. The application avoids global traversal scanning, reduces the network scanning budget, and improves the network scanning efficiency.

Description

A dynamic feedback method and system for generating active IPv6 addresses Technical Field

[0001] This invention relates to the field of cyberspace detection technology, and in particular to a dynamic feedback method and system for generating active IPv6 addresses. Background Technology

[0002] Network scanning can be used to discover vulnerabilities and security risks in a network, enabling timely measures to strengthen network security. Furthermore, network scanning can help network administrators understand network topology, configure networks, and monitor the operation of network services, thereby better managing and maintaining the network.

[0003] The internet has been around for decades, connecting countless network devices. With the advent of the Internet of Things (IoT) era, the number of network devices has exploded. The biggest problem facing IPv4 networks is the shortage of network address resources, severely restricting internet applications and development. The emergence of IPv6 networks has completely solved this problem. The IPv6 address protocol has been available for many years, and countries are accelerating its deployment. An effective way to understand the status of IPv6 networks is to perform address scanning to understand their deployment status. However, compared to IPv4 addresses, scanning the IPv6 address space faces challenges such as a large address space and insufficient scanning capacity. Scanning the entire IPv6 address space would take hundreds of millions of years. Therefore, reducing the IPv6 address scanning space is crucial for understanding the status of IPv6 networks.

[0004] The existing approach to reducing the IPv6 scan space is mainly to discover as many potentially live IPv6 addresses as possible in address regions where IPv6 addresses are alive. Currently, there are two main methods: the first is patterned scanning, which allocates the scan budget based on the IPv6 address distribution density for a global scan; the second is to deduce the relationship between corresponding bytes based on the IPv6 address's own structural information, generate addresses, and then perform direct scanning. However, both methods suffer from uneven distribution of the scan budget and low detection efficiency. Summary of the Invention

[0005] To address the aforementioned problems, this invention provides a dynamic feedback-based method and system for generating active IPv6 addresses. The method involves pre-classifying the input IPv6 seed set according to network attribute information to obtain a set of addresses belonging to the same network domain. Then, it performs top-down hierarchical classification based on address structure information, ultimately resulting in an address region spatial tree. The address regions of the leaf nodes in the spatial tree are then generated using a nibble frequency value coverage algorithm. During scanning, the activity level of each address region dynamically guides the subsequent address generation scale, ensuring that the final number of scanned addresses reaches a set upper limit for the scan scale threshold.

[0006] To achieve the above objectives, the present invention provides a dynamic feedback method for generating active IPv6 addresses, comprising:

[0007] Obtain an IPv6 address dataset as a seed set for active addresses;

[0008] The active address seed set is preprocessed, and the preprocessed active address seed set is pre-classified by autonomous region to obtain multiple active address seed subsets;

[0009] Perform split hierarchical clustering operations on the active address seed subsets under each autonomous region to obtain an address region spatial tree for each;

[0010] Construct a survival priority queue, set the target address generation scale, pre-scan the address regions of each leaf node in the address region space tree to obtain the survival value of each leaf node address region, allocate the address scale according to the survival value, and put the address regions of each leaf node into the priority queue.

[0011] The address regions of the leaf nodes are dequeued in the priority queue according to their priority, and the address regions are scanned and addresses are generated according to the allocated address size.

[0012] Update the survival value of the address region, allocate the target address generation scale for the next round according to the new survival value, and re-enqueue the address region into the survival priority queue according to the survival value.

[0013] Repeat the scanning of the priority queue until the number of scanned addresses reaches the target address generation scale.

[0014] As a further improvement of the present invention, the active address seed set is preprocessed, including:

[0015] The IPv6 seed addresses in the active address seed set are subjected to address format verification and deduplication.

[0016] The IPv6 seed address, which is represented using the 0-bit compression method, is standardized to a colon-based hexadecimal representation, and the double colons are removed.

[0017] As a further improvement to the present invention, address pre-classification is performed on the preprocessed active address seed set; including:

[0018] The IPv6 seed addresses in the active address seed set are pre-classified according to the autonomous system and BGP prefix information to ensure that IPv6 seed addresses with the same autonomous system and network prefix are grouped into the same set.

[0019] As a further improvement of the present invention, a hierarchical clustering operation is performed on a subset of active address seeds within the same autonomous region to obtain an address region spatial tree; including:

[0020] Calculate the information entropy of each dimension in the active address seed set;

[0021] The minimum information entropy value is selected as the dimension for splitting;

[0022] The IPv6 seed addresses in the active address seed subset are divided according to whether their dimension values ​​are the same.

[0023] Repeat the partitioning operation multiple times until the number of addresses in the partitioned address region is minimized;

[0024] Construct an address set space tree based on the divided address regions.

[0025] As a further improvement of the present invention

[0026] Define the IPv6 seed address as having 32 dimensions and construct an address vector matrix;

[0027] In the address vector matrix, the dimension in which all column values ​​are the same is called the fixed dimension, and the dimension in which all column values ​​are different is called the free dimension. The information entropy value of all free dimensions is calculated as entropyQ.

[0028] Select the free dimension minDimen with the minimum current entropy value as the split dimension;

[0029] Within the active address seed subset, the active address seed subset is divided into multiple address region nodes based on whether the half-byte values ​​of the smallest free dimension minDimen are the same.

[0030] Repeat the above steps for the address region until the number of IPv6 seed addresses in the final address region is less than or equal to the threshold minSeeds, then stop the partitioning operation.

[0031] As a further improvement of the present invention, the address regions of leaf nodes are dequeued from the priority queue according to their priority, and the address regions are scanned and addresses are generated according to the allocated address size; including:

[0032] Sort the half-byte values ​​in the free dimension of each leaf node according to their frequency of occurrence, and fill in all the hexadecimal values ​​in the free dimension that have not appeared in the active address seed subset to form a candidate half-byte value sequence.

[0033] The target IPv6 address is generated by sequentially selecting half-byte values ​​from the candidate half-byte value sequence and copying them to candidate bits in the address pattern string.

[0034] As a further improvement of the present invention, in the set of all the target IPv6 addresses generated, addresses that have already appeared in the active address seed subset are removed.

[0035] As a further improvement of the present invention, scanning and address generation of the address region according to the allocated address size further includes:

[0036] The generated addresses are sampled using a reservoir sampling algorithm at a certain sampling rate SR. After sampling, ICMP messages are sent to probe the addresses. The existence of the address is determined by whether there is a response after sending an ICMP reply message, and the liveness value of the address area is updated.

[0037] As a further improvement to the present invention, a death delay queue is constructed;

[0038] When an address region with a survival rate of 0 is detected, the address region is removed from the survival priority queue and entered into the death delay queue, and will not participate in the next round of address generation.

[0039] Set the maximum number of retries for the address range;

[0040] The death delay queue is scanned cyclically, and addresses are generated and scanned for the dequeue address region;

[0041] If the address liveness is 0, the retry count for that address region is incremented by 1 and it is enqueued again in the death delay queue.

[0042] If the address region's liveness is greater than 0, it is directly restored to the liveness priority queue, and the number of retries is set to 0.

[0043] If the number of address region scans reaches the maximum number of retries, the address region is determined to be a dead region and removed from the dead delay queue, and no further address generation operations will be performed.

[0044] The present invention also provides a dynamic feedback IPv6 active address generation system, comprising: a preprocessing and preclassification module, a seed address clustering module, a priority queue enqueue module, an address generation module, and a dynamic feedback module;

[0045] The preprocessing and pre-classification module is used for:

[0046] Obtain an IPv6 address dataset as a seed set for active addresses;

[0047] The active address seed set is preprocessed, and the preprocessed active address seed set is pre-classified by autonomous region to obtain multiple active address seed subsets;

[0048] The seed address clustering module is used for:

[0049] Perform split hierarchical clustering operations on the active address seed subsets under each autonomous region to obtain an address region spatial tree for each;

[0050] The priority queue enqueue module is used for:

[0051] Construct a survival priority queue, set the target address generation scale, pre-scan the address regions of each leaf node in the address region space tree to obtain the survival value of each leaf node address region, allocate the address scale according to the survival value, and put the address regions of each leaf node into the priority queue.

[0052] The address generation module is used for:

[0053] The address regions of the leaf nodes are dequeued in the priority queue according to their priority, and the address regions are scanned and addresses are generated according to the allocated address size.

[0054] Repeat the scanning of the priority queue until the number of scanned addresses reaches the target address generation scale;

[0055] The dynamic feedback module is used for:

[0056] Update the survival value of the address region, allocate the target address generation scale for the next round according to the new survival value, and re-enqueue the address region into the survival priority queue according to the survival value.

[0057] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0058] This invention addresses the issue from the perspectives of scan budget and scan efficiency. First, it coarsely classifies the seed address set according to autonomous systems, improving address region relevance. Then, it performs fine-grained division of address regions based on address dimension information entropy values. Simultaneously, it uses a survival priority queue to store address region scan results, dynamically adjusting the priority and scale of subsequent address generation based on these results. Compared to ordinary scanning methods, this invention's dynamic feedback scanning approach significantly improves the hit rate within the same scan time. Therefore, dynamic feedback generation scanning can dynamically adjust the search direction, reducing the search space and increasing the number of effective addresses generated, thereby optimizing the overall survival rate, reducing the network scan budget, and improving network scan efficiency.

[0059] This invention utilizes network autonomous system information to pre-classify seed address sets, improving the relevance of addresses within the set. It employs a split-level clustering algorithm based on information entropy to heuristically partition address regions, generating corresponding address patterns and then constructing Cartesian product combinations based on the frequency of address nibble bits. In the final probing phase, a dynamic feedback mechanism is used to dynamically update the predicted address region viability, guiding the scale of address generation. This tilts the network probe budget towards high-density address regions, avoiding global traversal scanning, reducing the network scanning budget, and improving network scanning efficiency.

[0060] This invention sets up a two-level priority queue consisting of a survival priority queue and a death delay queue to store the results of address region scanning. It also performs a special scan and result processing on the death delay queue to prevent address regions with a survival rate of 0 from remaining in the survival priority queue, thus avoiding wasting address generation time and reducing address generation efficiency. At the same time, this application allocates address sizes to address regions by calculating the size of the survival value, which is a search strategy planning that can generate active addresses better and faster. Attached Figure Description

[0061] Figure 1 is a flowchart of a dynamic feedback-based IPv6 active address generation method disclosed in an embodiment of the present invention;

[0062] Figure 2 is a schematic diagram of a dynamic feedback IPv6 active address generation system disclosed in an embodiment of the present invention;

[0063] Figure 3 is a schematic diagram of IPv6 address pre-classification disclosed in an embodiment of the present invention;

[0064] Figure 4 is a flowchart of address region splitting according to an embodiment of the present invention;

[0065] Figure 5 is a schematic diagram of address region node splitting according to an embodiment of the present invention;

[0066] Figure 6 is a schematic diagram of the dynamic feedback address generation and scanning process disclosed in an embodiment of the present invention;

[0067] Figure 7 is a schematic diagram of a two-level queue feedback scan disclosed in an embodiment of the present invention. Detailed Implementation

[0068] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0069] The present invention will now be described in further detail with reference to the accompanying drawings:

[0070] As shown in Figure 1, the present invention provides a dynamic feedback method for generating active IPv6 addresses, comprising the following steps:

[0071] S1. Obtain the IPv6 address dataset as an active address seed set;

[0072] in,

[0073] The available information is the set of active IPv6 Hitlist addresses published by Gasser et al.

[0074] S2. Preprocess the active address seed set, and pre-classify the preprocessed active address seed set according to autonomous regions to obtain multiple active address seed subsets;

[0075] in,

[0076] (1) The active address seed set is preprocessed, as shown in Figure 3, including:

[0077] Perform address format verification and deduplication on the IPv6 seed addresses in the active address seed set;

[0078] The IPv6 seed address, which is represented using the 0-bit compression method, is standardized to a colon-based hexadecimal representation, and the double colons are removed.

[0079] (2) And perform address pre-classification on the preprocessed active address seed set; including:

[0080] The IPv6 seed addresses in the active address seed set are pre-classified according to the autonomous system and BGP prefix information to ensure that IPv6 seed addresses with the same autonomous system and network prefix are grouped into the same set.

[0081] S3. As shown in Figure 4, perform split hierarchical clustering operations on the active address seed subsets under each autonomous region to obtain an address region spatial tree.

[0082] This includes:

[0083] Calculate the information entropy of each dimension in the active address seed set;

[0084] The minimum information entropy value is selected as the dimension for splitting;

[0085] The IPv6 seed addresses in the active address seed subset are divided according to whether their dimension values ​​are the same.

[0086] Repeat the partitioning operation multiple times until the number of addresses in the partitioned address region is minimized;

[0087] Construct an address set space tree based on the divided address regions.

[0088] Furthermore, as shown in Figure 5:

[0089] Define the IPv6 seed address as having 32 dimensions and construct an address vector matrix;

[0090] In the address vector matrix, the dimension in which all column values ​​are the same is called the fixed dimension, and the dimension in which all column values ​​are different is called the free dimension. Calculate the entropy value of all free dimensions, entropyQ.

[0091] Select the free dimension minDimen with the minimum current entropy value as the split dimension;

[0092] Within the active address seed subset, the active address seed subset is divided into multiple address region nodes based on whether the half-byte values ​​of the smallest free dimension minDimen are the same.

[0093] Repeat the above steps for the address region until the number of IPv6 seed addresses in the final address region is less than or equal to the threshold minSeeds, then stop the partitioning operation.

[0094] Specifically,

[0095] The specific algorithm formulas and explanations involved are as follows:

[0096] Information entropy calculation:

[0097] This represents the information entropy definition of the i-th half-byte bit.

[0098] S4. Construct a survival priority queue, build a death delay queue, set the target address generation scale, pre-scan the address regions of each leaf node in the address region space tree, obtain the survival value of each leaf node address region, allocate the address scale according to the survival value, and put the address regions of each leaf node into the priority queue.

[0099] As shown in Figures 6 and 7:

[0100] A survival priority queue is constructed to store active address regions, and a death delay queue stores non-surviving address regions. Multiple rounds of address generation and scanning operations are performed. Before each round of scanning, the addresses to be scanned are sampled using a reservoir sampling algorithm. Address regions are sequentially entered into the survival queue according to their survival rate. In the next round of scanning, address generation operations are prioritized for address regions with high survival rates. At the same time, the address generation operation in the next round is rewarded or penalized according to the results of the current round of scanning, thereby dynamically increasing or decreasing the scale of address region generation. For address regions with a survival rate of 0 in a certain round of scanning, they are entered into the death delay queue and do not participate in the next round of address generation. They are restored to the survival queue when a surviving address is detected; otherwise, they are discarded or deleted.

[0101] Furthermore,

[0102] Set the pre-generated address size GenNum, the number of iterative scan rounds δ, and the reward coefficient reward.

[0103] Set up a survival priority queue PQ for address regions. Initially, perform a pre-scan on the address regions to obtain the estimated survival value AQ of the address regions. Then, put each address region into the survival priority queue PQ in order of the survival value AQ.

[0104] Address regions are dequeued from the survival priority queue PQ in order of priority. Address generation is performed on the dequeued address regions. At the same time, before scanning, the generated addresses are sampled using a reservoir sampling algorithm at a certain sampling rate SR. After sampling, ICMP messages are sent to probe the addresses. The existence of the address is determined by whether there is a response after sending an ICMP reply message. The survival value AQ of the current address region is updated, the size of the address region to be generated in the next round is calculated, and the address regions are requeued according to their survival value.

[0105] After each address region scan, corresponding reward or penalty operations are performed based on the address survival value. Address regions with higher survival values ​​(AQ) after scanning will receive higher priority and larger address generation scale in the next scan, while address regions with lower survival values ​​(AQ) will receive lower priority and smaller address generation scale in the next scan. At the same time, for address regions with a survival value (AQ) of 0, they are removed from the survival priority queue (PQ) and placed into the dead latency queue (DLQ), and a maximum number of retries (η) is set for the address region. The above operation is repeated multiple times until the number of scan rounds reaches the maximum value (δ) or the number of scanned addresses reaches the pre-generated address scale (GenNum).

[0106] As shown in Figure 6, the death delay queue DLQ is scanned cyclically: when the death delay queue DLQ is not empty, an element dequeue operation is performed. The dequeued address region is generated and scanned. If the address survival rate is 0, the retry count for the address region is incremented by 1 and it is re-enqueued. If the address region survival rate is greater than 0, it is directly restored to the survival queue PQ and the retry count is set to 0. If the number of address region scans reaches the maximum retry count η, the address region is determined to be a dead region and removed from the DLQ queue. No further address generation operation is performed.

[0107] Specifically,

[0108] Water storage tank sampling formula:

[0109] Where rt(j) represents the probability that the j-th sampled value is retained, and rt is...

[0110] Next round address generation size for the address region:

[0111] Where addr_next is the address generation scale of the address region in the next round, addr_curr is the address generation scale of the address region in the current round, reward is the reward coefficient, and α is the average survival value of the address region in the previous round of scanning.

[0112] Total address size:

[0113] Where δ is the number of iterations, N is the number of address regions, and R i This represents the number of addresses generated for the i-th address region.

[0114] S5. Dequeue the address regions of leaf nodes from the priority queue according to their priority, and scan and generate addresses for the assigned address regions according to their allocated address size.

[0115] This includes:

[0116] Sort the half-byte values ​​in the free dimension of each leaf node according to their frequency of occurrence, and fill in all the hexadecimal values ​​in the free dimension that have not appeared in the active address seed subset to form a candidate half-byte value sequence.

[0117] The target IPv6 address is generated by sequentially selecting nibbles from the candidate nibbles value sequence and copying them to the candidate bits in the address pattern string.

[0118] Furthermore,

[0119] In the set of all generated target IPv6 addresses, remove addresses that have already appeared in the active address seed subset.

[0120] S6. Update the survival value of the address region, allocate the target address generation scale for the next round to the address region according to the new survival value, and re-enqueue the address region into the survival priority queue according to the survival value.

[0121] in,

[0122] The generated addresses are sampled using a reservoir sampling algorithm at a certain sampling rate SR. After sampling, ICMP messages are sent to probe the addresses. The existence of the address is determined by whether there is a response after sending an ICMP reply message, and the liveness value of the address area is updated.

[0123] S7. Repeatedly scan the priority queue until the number of scanned addresses reaches the target address generation scale.

[0124] This invention also includes: constructing a death delay queue;

[0125] As shown in Figure 7, when an address region with a survival rate of 0 is detected, the address region is removed from the survival priority queue and entered into the death delay queue, and will not participate in the next round of address generation.

[0126] Set the maximum number of retries for the address range;

[0127] The death delay queue is scanned in a loop, and addresses are generated and scanned for the dequeued address regions;

[0128] If the address liveness is 0, increment the retry count for that address region by 1 and add it back to the death delay queue.

[0129] If the address region's liveness is greater than 0, it is directly restored to the liveness priority queue, and the number of retries is set to 0.

[0130] If the number of address region scans reaches the maximum number of retries, the address region is determined to be a dead region and removed from the dead delay queue, and no further address generation operations will be performed.

[0131] As shown in Figure 2, the present invention also provides a dynamic feedback IPv6 active address generation system, characterized in that it includes: a preprocessing and pre-classification module, a seed address clustering module, a priority queue enqueue module, an address generation module, and a dynamic feedback module.

[0132] The preprocessing and pre-classification module is used for:

[0133] Obtain an IPv6 address dataset as a seed set for active addresses;

[0134] The active address seed set is preprocessed, and the preprocessed active address seed set is pre-classified by autonomous region to obtain multiple active address seed subsets;

[0135] The seed address clustering module is used for:

[0136] Perform split hierarchical clustering operations on the active address seed subsets under each autonomous region to obtain an address region spatial tree for each;

[0137] The priority queue enqueue module is used for:

[0138] Construct a survival priority queue, set the target address generation scale, pre-scan the address regions of each leaf node in the address region space tree, obtain the survival value of each leaf node address region, allocate the address scale according to the survival value, and put the address regions of each leaf node into the priority queue.

[0139] The address generation module is used for:

[0140] The address regions of leaf nodes are dequeued from the priority queue according to their priority, and then the address regions are scanned and addresses are generated according to their allocated address size.

[0141] Repeatedly scan the priority queue until the number of scanned addresses reaches the target address generation scale;

[0142] The dynamic feedback module is used for:

[0143] Update the survival value of the address region, allocate the target address generation scale for the next round based on the new survival value, and re-enqueue the address region into the survival priority queue according to the survival value.

[0144] Advantages of this invention:

[0145] This invention addresses the issue from the perspectives of scan budget and scan efficiency. First, it coarsely classifies the seed address set according to autonomous systems, improving address region relevance. Then, it performs fine-grained division of address regions based on address dimension information entropy values. Simultaneously, it uses a survival priority queue to store address region scan results, dynamically adjusting the priority and scale of subsequent address generation based on these results. Compared to ordinary scanning methods, this invention's dynamic feedback scanning approach significantly improves the hit rate within the same scan time. Therefore, dynamic feedback generation scanning can dynamically adjust the search direction, reducing the search space and increasing the number of effective addresses generated, thereby optimizing the overall survival rate, reducing the network scan budget, and improving network scan efficiency.

[0146] This invention utilizes network autonomous system information to pre-classify seed address sets, improving the relevance of addresses within the set. It employs a split-level clustering algorithm based on information entropy to heuristically partition address regions, generating corresponding address patterns and then constructing Cartesian product combinations based on the frequency of address nibble bits. In the final probing phase, a dynamic feedback mechanism is used to dynamically update the predicted address region viability, guiding the scale of address generation. This tilts the network probe budget towards high-density address regions, avoiding global traversal scanning, reducing the network scanning budget, and improving network scanning efficiency.

[0147] This invention sets up a two-level priority queue consisting of a survival priority queue and a death delay queue to store the results of address region scanning. It also performs a special scan and result processing on the death delay queue to prevent address regions with a survival rate of 0 from remaining in the survival priority queue, thus avoiding wasting address generation time and reducing address generation efficiency. At the same time, this application allocates address sizes to address regions by calculating the size of the survival value, which is a search strategy planning that can generate active addresses better and faster.

[0148] The above are merely preferred embodiments of the present invention and are not intended to limit the present invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A dynamic feedback method for generating active IPv6 addresses, characterized in that, include: Obtain an IPv6 address dataset as a seed set for active addresses; The active address seed set is preprocessed, and the preprocessed active address seed set is pre-classified by autonomous region to obtain multiple active address seed subsets; Perform split hierarchical clustering operations on the active address seed subsets under each autonomous region to obtain an address region spatial tree for each; A survival priority queue is constructed, a target address generation scale is set, and the address regions of each leaf node in the address region spatial tree are pre-scanned to obtain the survival value of each leaf node's address region. Address scales are allocated according to the survival values, and the address regions of each leaf node are added to the survival priority queue. The address regions of leaf nodes are dequeued from the survival priority queue according to their priority, and then scanned and generated according to their allocated address scales. The survival value of the address region is updated, and the address scale for the next round is allocated based on the new survival value. The address region is then re-enqueued into the survival priority queue according to its survival value. The survival priority queue is scanned repeatedly until the number of scanned addresses reaches the target address generation scale.

2. The dynamic feedback method for generating active IPv6 addresses according to claim 1, characterized in that: The active address seed set is preprocessed, including: performing address format verification and deduplication operations on the IPv6 seed addresses in the active address seed set; standardizing the IPv6 seed addresses represented by the 0-bit compression method to the colon-separated hexadecimal representation and removing the double colons.

3. The dynamic feedback method for generating active IPv6 addresses according to claim 1, characterized in that: A hierarchical clustering operation is performed on a subset of active address seeds under the same autonomous system to obtain an address region spatial tree. This includes: calculating the information entropy of each dimension in the subset of active address seeds; selecting the minimum information entropy value as the splitting dimension; dividing each IPv6 seed address in the subset of active address seeds according to whether the dimension values ​​are the same; repeating the splitting operation multiple times until the number of addresses in the resulting address regions is minimized; and constructing an address region spatial tree based on the resulting address regions.

4. The dynamic feedback method for generating active IPv6 addresses according to claim 3, characterized in that: Define the IPv6 seed address as 32-dimensional and construct an address vector matrix. Dimensions with identical column values ​​in the address vector matrix are called fixed dimensions, and dimensions with different column values ​​are called free dimensions. Calculate the entropy value (entropyQ) of all free dimensions. Select the free dimension (minDimen) with the smallest current entropy value as the splitting dimension. In the active address seed subset, divide the active address seed subset into multiple address region nodes according to whether the half-byte values ​​of the smallest free dimension (minDimen) are the same. Repeat the above partitioning steps for the partitioned active address seed subset until the number of IPv6 seed addresses in the final address region is less than or equal to the threshold (minSeeds), then stop the partitioning operation.

5. The dynamic feedback method for generating active IPv6 addresses according to claim 4, characterized in that: The address regions of leaf nodes are dequeued from the survival priority queue according to their priority. The address regions are then scanned and addresses are generated according to the allocated address size. This includes: sorting the leaf nodes according to the frequency of the occurrence of half-byte values ​​in the free dimension, and filling in all hexadecimal values ​​in the free dimension that do not appear in the active address seed subset to form a candidate half-byte value sequence; and sequentially selecting half-byte values ​​from the candidate half-byte value sequence and copying them to candidate positions in the address pattern string to generate the target IPv6 address.

6. The dynamic feedback method for generating active IPv6 addresses according to claim 5, characterized in that: In the set of all the target IPv6 addresses generated, remove addresses that have already appeared in the active address seed subset.

7. The dynamic feedback method for generating active IPv6 addresses according to claim 1, characterized in that: The process of scanning and generating addresses for the address region according to the allocated address size also includes: sampling the generated addresses using a reservoir sampling algorithm at a certain sampling rate SR; sending ICMP messages to probe the addresses after sampling is completed; determining whether the addresses exist by whether there is a response after sending ICMP reply messages; and updating the liveness value of the address region.

8. The dynamic feedback method for generating active IPv6 addresses according to claim 1, characterized in that: A death delay queue is constructed. When an address region with a survival rate of 0 is scanned, the address region is removed from the survival priority queue and added to the death delay queue, and it will not participate in the next round of address generation. The maximum number of retries for an address region is set. The death delay queue is scanned cyclically, and address generation and scanning are performed on dequeued address regions. If the address survival rate is 0, the retry count for the address region is incremented by 1 and it is re-enqueued in the death delay queue. If the address region survival rate is greater than 0, it is directly restored to the survival priority queue, and the retry count is set to 0. If the number of address region scans reaches the maximum number of retries, the address region is determined to be a dead region and removed from the death delay queue, and no further address generation operations will be performed.

9. A dynamic feedback IPv6 active address generation system implementing the method as described in any one of claims 1 to 8, characterized in that, include: The module includes a preprocessing and pre-classification module, a seed address clustering module, a priority queue enqueue module, an address generation module, and a dynamic feedback module. The preprocessing and preclassification module is used to: obtain an IPv6 address dataset as an active address seed set; The active address seed set is preprocessed, and the preprocessed active address seed set is pre-classified by autonomous region to obtain multiple active address seed subsets; The seed address clustering module is used to: perform split hierarchical clustering operations on the active address seed subsets under each autonomous domain to obtain an address region spatial tree respectively; The priority queue enqueue module is used to: construct a survival priority queue, set a target address generation scale, pre-scan the address regions of each leaf node in the address region spatial tree to obtain the survival value of each leaf node's address region, allocate address scale according to the survival value, and put the address regions of each leaf node into the survival priority queue; the address generation module is used to: dequeue the address regions of leaf nodes from the survival priority queue according to their priority, scan and generate addresses for the address regions according to their allocated address scale; repeatedly scan the survival priority queue until the number of scanned addresses reaches the target address generation scale; the dynamic feedback module is used to: update the survival value of the address region, allocate the address scale for the next round according to the new survival value, and re-enqueue the address region into the survival priority queue according to its survival value.

Images