A temporary IPv6 address terminal identification method, system, medium and device

Abstract

The present invention discloses a temporary IPv6 address terminal identification method, system, medium and equipment, wherein the system includes a data acquisition unit, a data processing unit, a user ID identification generation unit, a binding unit, an address binding pool, an IPv6 address PING unit, a summing-up and discrimination unit, an IPv6 address discrimination unit and a live detection unit, the data acquisition unit is connected in communication with the data processing unit, the data processing unit is connected in communication with the user ID identification generation unit and the binding unit respectively, the binding unit is connected in communication with the address binding pool, and the address binding pool is connected in communication with the IPv6 address PING detection unit, the summing-up and discrimination unit and the IPv6 address discrimination unit respectively. The present invention thoroughly solves the problem that temporary addresses are difficult to track and trace through an innovative, terminal-oriented IPv6 address identification mechanism, and provides a solid foundation for the refined management, security and reliability of IPv6 networks.

Description

Technical Field

[0001] The present invention relates to the field of routing technology, in particular to a temporary IPv6 address terminal identification method, system, medium and equipment. Background Art

[0002] In the current IPv6 network, terminal devices generally use temporary addresses to communicate with the Internet to protect their privacy and security. Temporary addresses have the following characteristics:

[0003] 1. It is generated by the terminal device itself and no longer relies on DHCPv6 or SLAAC for acquisition, so the address allocation record cannot be seen in the network.

[0004] 2. After using it for a period of time (usually a few hours to a few days, generally 24 hours), a new temporary address is replaced, and it changes frequently.

[0005] 3. Temporary addresses usually use a high-quality random number generation algorithm (such as the random number generator provided by the operating system) to randomly generate an interface identifier, which is combined with a network prefix to generate an IPv6 temporary address. It has no obvious association with the fixed identifier of the terminal device, such as the MAC address.

[0006] Because temporary addresses can effectively hide the true identity of the terminal and prevent network activities from being tracked, their use has become the best practice and de facto standard for IPv6 networks.

[0007] However, while the temporary address mechanism improves privacy protection capabilities, it also brings new challenges to network management:

[0008] 1. It is difficult to implement access control, traffic auditing, abnormal behavior analysis, etc. based on IP addresses because temporary addresses change frequently and are unclearly associated with terminal identities.

[0009] 2. It is difficult to investigate and collect evidence after security incidents, and it is impossible to trace the attack source based on the expired temporary address.

[0010] 3. It is impossible to directly inventory and control the assets in the network, and it is difficult to establish an accurate mapping relationship between IP addresses and terminals.

[0011] Traditional terminal identification and location methods, such as DHCP address binding, ARP table query, netflow analysis, etc., are ineffective in the IPv6 temporary address scenario. Administrators are faced with a series of randomly generated and frequently changing IPv6 addresses and cannot determine their ownership. When a suspicious terminal needs to be located, the temporary address becomes an "invisible cloak", which seriously hinders problem troubleshooting and attack tracing. Summary of the invention

[0012] To this end, the technical problem to be solved by the present invention is to provide a temporary IPv6 address terminal identification method, system, medium and equipment, which completely solves the problem that temporary addresses are difficult to track and trace through an innovative, terminal-oriented IPv6 address identification mechanism, and provides a solid foundation for the refined management, security and reliability of IPv6 networks.

[0013] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0014] A temporary IPv6 address terminal identification method comprises the following steps:

[0015] S1) Collect IPv6 traffic in real time and parse the data packets in the IPv6 traffic, collect the source IPv6 address, the MAC address corresponding to the source IPv6 address, the destination IPv6 address and the MAC address corresponding to the destination IPv6 address;

[0016] S2) filtering the IPv6 addresses collected in step S1) according to the known IPv6 address prefixes, and retaining the IPv6 addresses containing the IPv6 address prefixes;

[0017] S3) generating a unique user ID for each IPv6 address retained in step S2), and then binding the user ID, MAC address and IPv6 address to form binding information Bindings0, and adding the binding information Bindings0 to the address binding pool Pool1; wherein the user ID contains a continuous number of preset digits; in the binding information Bindings0, there is a mapping relationship between the user ID, MAC address and IPv6 address;

[0018] S4) Perform periodic PING tests on the IPv6 addresses in the address binding pool Pool1. If a certain IPv6 address cannot be PINGed within the preset time threshold T1, the binding information Bindings0 containing the IPv6 address is discarded.

[0019] S5) performs a summative judgment on the binding information Bindings0 that remains after being processed in step S4), and the specific steps are as follows:

[0020] S5-1) determining whether the MAC addresses in the binding information Bindings0 retained after the processing in step S4) are the same, for multiple user IDs that share the same MAC address, retain the user ID with the smallest consecutive number in the user ID identifier and generate binding information Bindings1, then add the binding information Bindings1 and the retained binding information Bindings0 to the address binding pool Pool2 and identify them as binding information Bindings2;

[0021] S5-2) Determine whether the MAC addresses in the binding information Bindings2 belong to the same terminal. If they belong to the same terminal, retain the user ID with the smallest consecutive digits in the user ID and generate the binding information Bindings3. Otherwise, retain the binding information Bindings2, then add the binding information Bindings3 and the retained binding information Bindings2 to the address binding pool Pool3 and mark them as binding information Bindings4; wherein, in the binding information Bindings1, the binding information Bindings2, the binding information Bindings3 and the binding information Bindings4, there is a mapping relationship between the user ID, the MAC address and the IPv6 address;

[0022] S6) Perform periodic PING tests on the IPv6 addresses in the binding information Bindings4. When an IPv6 address is inactivated within a preset time threshold T2, the IPv6 address is a temporary IPv6 address. Otherwise, the IPv6 address is a fixed IPv6 address. The preset time threshold T2 is 48 hours.

[0023] In the above temporary IPv6 address terminal identification method, in step S5-2), whether two MAC addresses belong to the same terminal is determined by the following method:

[0024] Send ICMPv6 data packets to all IPv6 addresses in address binding pool Pool2, obtain the TTL value, ICMP response time, ICMP identifier and sequence number, and ICMP message behavior characteristics of the return packet, and assign values ​​to the TTL value, ICMP response time, ICMP identifier and sequence number, and ICMP message behavior characteristics of the return packet, and then calculate the difference score of the return packets of any two IPv6 addresses based on the assigned TTL value, ICMP response time, ICMP identifier and sequence number, and ICMP message behavior characteristics. If the calculated difference score is greater than the threshold, it is determined that the terminals using the two IPv6 addresses are the same terminal, otherwise, it is determined that the terminals using the two IPv6 addresses are not the same terminal. Among them, the ICMP identifier of the return packet is set by the sender when sending the ICMP request, which is used to identify the corresponding request and response. Therefore, the consistency of the ICMP identifiers in the return packets of the two IPv6 addresses only indicates the relationship between their requests and responses, rather than a unique feature of IPv6.

[0025] In the above temporary IPv6 address terminal identification method, in step S5-2), the difference score is calculated by the following formula:

[0026]

[0027] Wherein, W1 is the weight of the TTL value difference score; S1 is the TTL value difference score; W2 is the weight of the ICMP response time difference score; S2 is the ICMP response time difference score; W3 is the weight of the ICMP identifier and sequence number difference score; S3 is the ICMP identifier and sequence number difference score; W4 is the weight of the ICMP message behavior feature difference score; S4 is the ICMP message behavior feature difference score.

[0028] In the above temporary IPv6 address terminal identification method, S1 is calculated by the following formula:

[0029]

[0030]

[0031] Where, e is a natural constant; HOP - It is the difference of the average number of hops after two data packets reach the destination, and its value range is an integer greater than or equal to 0; To obtain the average TTL value after N-times evaluation of the x-th IPv6 address in address binding pool Pool2; The average TTL value is obtained after N evaluations are performed on the yth IPv6 address in address binding pool Pool2; N is a natural number greater than or equal to 3;

[0032] S2 is assigned a value using the following formula:

[0033]

[0034]

[0035]

[0036] Where D_RT is the difference between the average ICMP response time of the x-th IPv6 address in address binding pool Pool2 and the average ICMP response time of the y-th IPv6 address in address binding pool Pool2, which is a positive number; ICMP_RT is the average ICMP response time obtained after N PING measurements, in milliseconds; is the response time of the i-th PING timing request; The sending time of the i-th PING timing request;

[0037] S3 is assigned a value using the following formula:

[0038]

[0039] In the formula, Identifier Match is the identifier matching degree, and Identifier Match is determined according to the following rules:

[0040] If the ICMP identifiers of the two IPv6 address packets are exactly the same, the Identifier Match value is 1; if the ICMP identifiers of the two IPv6 address packets are partially matched or the same or comply with the same policy, the Identifier Match value range is (0, 1); if the ICMP identifiers of the two IPv6 address packets are completely inconsistent, the Identifier Match value is 0;

[0041] Sequence Number Match is the sequence number matching degree. Sequence Number Match takes values ​​according to the following rules:

[0042] If the ICMP sequence numbers of the two IPv6 addresses are exactly the same, the Sequence Number Match value is 1; if the ICMP sequence numbers of the two IPv6 addresses are partially matched or the same or comply with the same policy, the Sequence Number Match value range is (0, 1); if the ICMP sequence numbers of the two IPv6 addresses are completely inconsistent, the Sequence Number Match value is 0;

[0043] ω1 is the weight of Identifier Match, ω2 is the weight of Sequence Number Match;

[0044] S4 is assigned a value using the following formula:

[0045]

[0046]

[0047]

[0048]

[0049]

[0050]

[0051]

[0052]

[0053]

[0054] Where δ1 is the weight associated with D_PLR; D_PLR is the average packet loss rate of the xth IPv6 address in address binding pool Pool2 Average packet loss rate of the yth IPv6 address in address binding pool Pool2 The difference between; is the packet loss rate of the i-th PING test for an IPv6 address in address binding pool Pool2; Number of Lost Packets is the number of lost packets; Total Number of Sent Packets is the total number of sent packets; δ2 is the weight related to D_ICMPER; D_ICMPER is the average ICMP error rate of the x-th IPv6 address in address binding pool Pool2 Average ICMP error rate of the yth IPv6 address in address binding pool Pool2 The difference between is the ICMP error rate when performing the i-th PING test on an IPv6 address in address binding pool Pool2; Number of ICMP Errors is the number of ICMP errors; Total Number of ICMP Massages is the total number of ICMP messages; δ3 is the weight related to D_AMS; D_AMS is the average message size of the x-th IPv6 address in address binding pool Pool2 Average message size for the yth IPv6 address in address binding pool Pool2 The difference between It is the size of the reply packet when the i-th PING test is performed on an IPv6 address in address binding pool Pool2.

[0055] In the above temporary IPv6 address terminal identification method, the periodic PING test is performed once every thirty minutes.

[0056] A system for terminal identification using the temporary IPv6 address terminal identification method, comprising:

[0057] A data collection unit is used to collect IPv6 traffic and parse the data packets in the IPv6 traffic and collect the source IPv6 address, the MAC address corresponding to the source IPv6 address, the destination IPv6 address and the MAC address corresponding to the destination IPv6 address;

[0058] A data processing unit, used for filtering the IPv6 addresses obtained by the data collection unit according to the known IPv6 address prefix and retaining the IPv6 addresses containing the IPv6 address prefix;

[0059] A user ID generation unit, used to generate a unique user ID for each retained IPv6 address;

[0060] A binding unit, used to bind an IPv6 address with a related MAC address and a user ID;

[0061] An address binding pool, used to store binding information. The address binding pool includes address binding pool Pool1, address binding pool Pool2 and address binding pool Pool3. Among them, address binding pool Pool1 is used to store binding information Bindings0, address binding pool Pool2 is used to store binding information Bindings2, and address binding pool Pool3 is used to store binding information Bindings4;

[0062] IPv6 address PING test unit, used to perform indirect PING test on IPv6 addresses in the address binding pool;

[0063] The summing and distinguishing unit is used to distinguish the same MAC address and the same user of the IPv6 addresses in the address binding pool and output the distinguishing result;

[0064] An IPv6 address determination unit is used to determine whether the IPv6 address in the output result of the summary determination unit is a temporary IPv6 address;

[0065] The data acquisition unit is communicatively connected to the data processing unit, the data processing unit is communicatively connected to the user ID identification generation unit and the binding unit respectively, the binding unit is communicatively connected to the address binding pool Pool1, the address binding pool Pool1 is communicatively connected to the IPv6 address PING measurement unit and the summary determination unit respectively, the IPv6 address PING measurement unit is communicatively connected to the summary determination unit, the summary determination unit is communicatively connected to the address binding pool Pool2 and the address binding pool Pool3 respectively, and the address binding pool Pool3 is communicatively connected to the IPv6 address determination unit.

[0066] In the above system, the summing-up and determination unit comprises a TTL value analysis and calculation module, an ICMP response time analysis and calculation module, an ICMP identifier and sequence number analysis and calculation module, an ICMP message behavior characteristic analysis and calculation module, a comprehensive calculation analysis and determination module and a summing-up and binding module. The summing-up and binding module is connected in communication with the comprehensive calculation analysis and determination module. The comprehensive calculation analysis and determination module is connected in communication with the TTL value analysis and calculation module, the ICMP response time analysis and calculation module, the ICMP identifier and sequence number analysis and calculation module and the ICMP message behavior characteristic analysis and calculation module respectively. The TTL value analysis and calculation module is used to calculate the value related to the TTL of the IPv6 address according to the result of the PING measurement of the IPv6 address in the address binding pool by the IPv6 address PING measurement unit, and the ICMP response time analysis and calculation module is used to calculate the value related to the ICMP response time of the IPv6 address according to the result of the PING measurement of the IPv6 address in the address binding pool by the IPv6 address PING measurement unit. The ICMP identifier and sequence number analysis and calculation module is used to calculate the numerical value related to the ICMP identifier and sequence number of the IPv6 address according to the PING measurement result of the IPv6 address in the address binding pool by the IPv6 address PING measurement unit; the ICMP message behavior characteristic analysis and calculation module is used to calculate the numerical value related to the ICMP message behavior characteristic of the IPv6 address according to the PING measurement result of the IPv6 address in the address binding pool by the IPv6 address PING measurement unit; the comprehensive calculation and analysis judgment module is used to perform comprehensive calculation according to the results output by the TTL value analysis and calculation module, the ICMP response time analysis and calculation module, the ICMP identifier and sequence number analysis and calculation module, and the ICMP message behavior characteristic analysis and calculation module, and to perform the same MAC address and the same user attribution judgment on the IPv6 addresses in the address binding pool; the attribution binding module is used to bind the IPv6 address with the corresponding MAC address and the user ID according to the judgment result output by the comprehensive calculation and analysis judgment module.

[0067] The above system also includes a liveness detection unit for periodically detecting the liveness status of the IP address, and the liveness detection unit is communicatively connected with the IP address determination unit.

[0068] A computer-readable storage medium stores a computer program, which implements the temporary IPv6 address terminal identification method when executed by a processor.

[0069] A computer device includes a readable storage medium, a processor, and a computer program stored in the readable storage medium and executable on the processor, wherein the computer program implements the temporary IPv6 address terminal identification method when executed by the processor.

[0070] The technical solution of the present invention achieves the following beneficial technical effects:

[0071] 1. The present invention realizes accurate identification and binding of terminal devices through combined analysis of multi-dimensional features and quantitative scoring, and is suitable for fields such as network management, terminal identification and network security.

[0072] 2. The present invention combines multiple network features, such as TTL value, ICMP response time, ICMP identifier and sequence number, and ICMP message behavior characteristics, for comprehensive analysis, which not only improves the accuracy of identifying the same terminal device, but also effectively reduces the misjudgment rate. This multi-dimensional comprehensive determination method can accurately capture the characteristics of terminal devices and effectively distinguish different devices even in similar operating systems and network configuration environments. This makes the present invention have obvious advantages in network management, terminal identification and security, especially in complex and dynamic network environments, thereby overcoming the limitations of the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] Figure 1 It is a working principle diagram of the temporary IPv6 address terminal identification system in the present invention;

[0074] Figure 2 A flowchart of temporary IPv6 address terminal identification in the present invention;

[0075] Figure 3 Flow chart of the present invention for determining the summability of binding information Bingdings0

[0076] Figure 4 The schematic diagram of a computer device capable of performing temporary IPv6 address terminal identification. DETAILED DESCRIPTION

[0077] The present invention is further described below with reference to examples.

[0078] like Figure 1 As shown, the temporary IPv6 address terminal identification system in the present invention includes a data collection unit, a data processing unit, a user ID generation unit, a binding unit, an address binding pool, an IPv6 address PING unit, a summary determination unit, an IPv6 address determination unit and a live detection unit.

[0079] The data collection unit is used to collect IPv6 traffic and parse the data packets in the IPv6 traffic and collect the source IPv6 address, the MAC address corresponding to the source IPv6 address, the destination IPv6 address and the MAC address corresponding to the destination IPv6 address; the data processing unit is used to filter the IPv6 addresses obtained by the data collection unit according to the known IPv6 address prefix and retain the IPv6 addresses containing the IPv6 address prefix; the user ID identification generation unit is used to generate a unique user ID identification for each retained IPv6 address; the binding unit is used to bind the IPv6 address with the relevant MAC address and user ID identification; the address binding pool includes address binding pool Pool1, address binding pool Pool2, and address binding pool Pool3. 2 and address binding pool Pool3, wherein address binding pool Pool1 is used to store binding information Bindings0, address binding pool Pool2 is used to store binding information Bindings2, and address binding pool Pool3 is used to store binding information Bindings4; an IPv6 address PING test unit, used to perform an indirect PING test on the IPv6 addresses in the address binding pool; a summarization and determination unit, used to perform summarization and determination of the same MAC address and the same user on the IPv6 addresses in the address binding pool and output the determination result; an IPv6 address determination unit, used to determine whether the IPv6 address in the output result of the summarization and determination unit is a temporary IPv6 address; and a live detection unit, used to periodically detect the live status of the IP address.

[0080] The data acquisition unit is communicatively connected to the data processing unit, the data processing unit is communicatively connected to the user ID identification generation unit and the binding unit respectively, the binding unit is communicatively connected to the address binding pool Pool1, the address binding pool Pool1 is communicatively connected to the IPv6 address PING measurement unit and the summary determination unit respectively, the IPv6 address PING measurement unit is communicatively connected to the summary determination unit, the summary determination unit is communicatively connected to the address binding pool Pool2 and the address binding pool Pool3 respectively, and the address binding pool Pool3 is communicatively connected to the IPv6 address determination unit.

[0081] In the present invention, the summing-up and distinguishing unit comprises a TTL value analysis and calculation module, an ICMP response time analysis and calculation module, an ICMP identifier and sequence number analysis and calculation module, an ICMP message behavior characteristic analysis and calculation module, a comprehensive calculation analysis and distinguishing module and a summing-up and binding module, the summing-up and binding module is communicated with the comprehensive calculation analysis and distinguishing module, and the comprehensive calculation analysis and distinguishing module is communicated with the TTL value analysis and calculation module, the ICMP response time analysis and calculation module, the ICMP identifier and sequence number analysis and calculation module and the ICMP message behavior characteristic analysis and calculation module respectively; wherein the TTL value analysis and calculation module is used to calculate a value related to the TTL of the IPv6 address according to the result of the PING measurement of the IPv6 address in the address binding pool by the IPv6 address PING measurement unit, and the ICMP response time analysis and calculation module is used to calculate a value related to the ICMP response time of the IPv6 address according to the result of the PING measurement of the IPv6 address in the address binding pool by the IPv6 address PING measurement unit. The ICMP identifier and sequence number analysis and calculation module is used to calculate the numerical value related to the ICMP identifier and sequence number of the IPv6 address according to the PING measurement result of the IPv6 address in the address binding pool by the IPv6 address PING measurement unit; the ICMP message behavior characteristic analysis and calculation module is used to calculate the numerical value related to the ICMP message behavior characteristic of the IPv6 address according to the PING measurement result of the IPv6 address in the address binding pool by the IPv6 address PING measurement unit; the comprehensive calculation and analysis judgment module is used to perform comprehensive calculation according to the results output by the TTL value analysis and calculation module, the ICMP response time analysis and calculation module, the ICMP identifier and sequence number analysis and calculation module, and the ICMP message behavior characteristic analysis and calculation module, and to perform the same MAC address and the same user attribution judgment on the IPv6 addresses in the address binding pool; the attribution binding module is used to bind the IPv6 address with the corresponding MAC address and the user ID according to the judgment result output by the comprehensive calculation and analysis judgment module.

[0082] like Figure 2 and Figure 3 As shown, the temporary IPv6 address terminal identification system of the present invention implements temporary IPv6 address terminal identification through the following steps:

[0083] S1) Collect IPv6 traffic in real time and parse the data packets in the IPv6 traffic, collect the source IPv6 address, the MAC address corresponding to the source IPv6 address, the destination IPv6 address and the MAC address corresponding to the destination IPv6 address;

[0084] S2) filtering the IPv6 addresses collected in step S1) according to the known IPv6 address prefixes, and retaining the IPv6 addresses containing the IPv6 address prefixes;

[0085] S3) generating a unique user ID for each IPv6 address retained in step S2), and then binding the user ID, MAC address and IPv6 address to form binding information Bindings0, and adding the binding information Bindings0 to the address binding pool Pool1; wherein the user ID contains a continuous number of preset digits; in the binding information Bindings0, there is a mapping relationship between the user ID, MAC address and IPv6 address;

[0086] S4) Perform periodic PING tests on the IPv6 addresses in the address binding pool Pool1. If a certain IPv6 address cannot be PINGed within the preset time threshold T1, the binding information Bindings0 containing the IPv6 address is discarded.

[0087] S5) performs a summative judgment on the binding information Bindings0 that remains after being processed in step S4), and the specific steps are as follows:

[0088] S5-1) determining whether the MAC addresses in the binding information Bindings0 retained after the processing in step S4) are the same, for multiple user IDs that share the same MAC address, retain the user ID with the smallest consecutive number in the user ID identifier and generate binding information Bindings1, then add the binding information Bindings1 and the retained binding information Bindings0 to the address binding pool Pool2 and identify them as binding information Bindings2;

[0089] S5-2) Determine whether the MAC addresses in the binding information Bindings2 belong to the same terminal. If they belong to the same terminal, retain the user ID with the smallest consecutive digits in the user ID and generate the binding information Bindings3. Otherwise, retain the binding information Bindings2, then add the binding information Bindings3 and the retained binding information Bindings2 to the address binding pool Pool3 and mark them as binding information Bindings4; wherein, in the binding information Bindings1, the binding information Bindings2, the binding information Bindings3 and the binding information Bindings4, there is a mapping relationship between the user ID, the MAC address and the IPv6 address;

[0090] S6) Perform periodic PING tests on the IPv6 addresses in the binding information Bindings4. When an IPv6 address is inactivated within a preset time threshold T2, the IPv6 address is a temporary IPv6 address. Otherwise, the IPv6 address is a fixed IPv6 address. The PING test period is thirty minutes, and the preset time threshold T2 is 48 hours.

[0091] Generally, when two or more MAC addresses belong to the same terminal, when performing a PING test on the IPv6 addresses corresponding to these MAC addresses, some characteristic information in the PING test packet will be the same or conform to the same rule policy, such as the TTL value, ICMP response time, ICMP identifier and sequence number, and ICMP message behavior characteristics in the PING test packet. The specific descriptions are as follows:

[0092] (1) Because different operating systems usually have a fixed TTL initial value (called Hop Limit in IPv6) for processing ICMP messages, by comparing the TTL values ​​of the PING response packets of two IPv6 addresses, if the two IPv6 addresses belong to the same terminal, the TTL values ​​when they respond to ICMP requests are usually the same, that is, the TTL values ​​of the PING response packets of the two IPv6 addresses, then the two IPv6 addresses may belong to the same terminal.

[0093] (2) Since the time difference when the same terminal responds to ICMP requests is usually small, and different terminals may have large differences in response time due to different processing speeds, network paths, etc., if the ICMP response times of two IPv6 addresses are very close and the results of multiple tests are consistent, then the two IPv6 addresses may belong to the same terminal.

[0094] (3) ICMP Echo requests usually contain an identifier and a sequence number, which are used to identify requests and track responses. The operating system may process these two fields in a consistent manner. If the ICMP responses returned by two IPv6 addresses in the same time period have the same or continuous identifier and sequence number, they may come from the same terminal. That is, if there is a logical relationship between the identifiers and sequence numbers returned by the two IPv6 addresses (such as the same or continuous, that is, the same or in accordance with the same rule policy), the two IPv6 addresses may belong to the same terminal.

[0095] (4) Different operating systems may have different behavioral characteristics when generating ICMP responses. For example, some operating systems may return customized ICMP responses under specific network configurations. By analyzing these behavioral characteristics, it is possible to infer whether two IPv6 addresses come from the same terminal. Send a series of ICMP requests to two IPv6 addresses and observe different types of ICMP responses (such as TTL expiration, fragment unreachable, etc.). Analyze the structure, size, response type, etc. of the returned message. If the ICMP response behavior of the two IPv6 addresses is consistent, then the two IPv6 addresses may come from the same terminal.

[0096] In view of the fact that the four situations mentioned in (1), (2), (3) and (4) are somewhat accidental, that is, the TTL value, ICMP response time, ICMP identifier and sequence number or ICMP message behavior characteristics in the corresponding PING test return packet of the IPv6 address that does not belong to the same terminal may be the same or conform to the same rule strategy. In order to improve the accuracy of judgment, the TTL value, ICMP response time, ICMP identifier and sequence number and ICMP message behavior characteristics are combined in the present invention.

[0097] Specifically, in step S5-2), whether the two MAC addresses belong to the same terminal is determined by the following method:

[0098] Send ICMPV6 data packets to all IPv6 addresses in address binding pool Pool2, obtain the TTL value, ICMP response time, ICMP identifier and sequence number, and ICMP message behavior characteristics of the return packet, and assign values ​​to the TTL value, ICMP response time, ICMP identifier and sequence number, and ICMP message behavior characteristics of the return packet. Then, calculate the difference score of the return packets of any two IPv6 addresses based on the assigned TTL value, ICMP response time, ICMP identifier and sequence number, and ICMP message behavior characteristics. If the calculated difference score is greater than the threshold, it is determined that the terminals using the two IPv6 addresses are the same terminal. Otherwise, it is determined that the terminals using the two IPv6 addresses are not the same terminal. The threshold is 85.

[0099] In step S5-2), the difference score is calculated by the following formula:

[0100]

[0101] Wherein, W1 is the weight of the TTL value difference score; S1 is the TTL value difference score; W2 is the weight of the ICMP response time difference score; S2 is the ICMP response time difference score; W3 is the weight of the ICMP identifier and sequence number difference score; S3 is the ICMP identifier and sequence number difference score; W4 is the weight of the ICMP message behavior feature difference score; S4 is the ICMP message behavior feature difference score. Among them, in the present invention, preferably, W1 is 0.2, W2 is 0.15, W3 is 0.45, and W4 is 0.2.

[0102] In this embodiment, S1 is calculated by the following formula:

[0103]

[0104]

[0105] Where, e is a natural constant; HOP - It is the difference of the average number of hops after two data packets reach the destination, and its value range is an integer greater than or equal to 0; To obtain the average TTL value after N-times evaluation of the x-th IPv6 address in address binding pool Pool2; The average TTL value is obtained after N evaluations are performed on the yth IPv6 address in address binding pool Pool2; N is a natural number greater than or equal to 3;

[0106] S2 is assigned a value using the following formula:

[0107]

[0108]

[0109]

[0110] Where D_RT is the difference between the average ICMP response time of the x-th IPv6 address in address binding pool Pool2 and the average ICMP response time of the y-th IPv6 address in address binding pool Pool2, which is a positive number; ICMP_RT is the average ICMP response time obtained after N PING measurements, in milliseconds; is the response time of the i-th PING timing request; is the sending time of the i-th PING timing request; 5ms is a default value, which can be adjusted according to the actual situation to suit different application scenarios and make the data more accurate and the calculation results more precise;

[0111] S3 is assigned by the following formula:

[0112]

[0113] In the formula, Identifier Match is the identifier matching degree, and Identifier Match is determined according to the following rules:

[0114] If the ICMP identifiers of the two IPv6 address packets are exactly the same, the Identifier Match value is 1; if the ICMP identifiers of the two IPv6 address packets are partially matched or the same or comply with the same policy, the Identifier Match value range is (0, 1); if the ICMP identifiers of the two IPv6 address packets are completely inconsistent, the Identifier Match value is 0;

[0115] Sequence Number Match is the sequence number matching degree. Sequence Number Match takes values ​​according to the following rules:

[0116] If the ICMP sequence numbers of the two IPv6 addresses are exactly the same, the Sequence Number Match value is 1; if the ICMP sequence numbers of the two IPv6 addresses are partially matched or the same or comply with the same policy, the Sequence Number Match value range is (0, 1); if the ICMP sequence numbers of the two IPv6 addresses are completely inconsistent, the Sequence Number Match value is 0;

[0117] ω1 is the weight of Identifier Match, preferably 0.4; ω2 is the weight of Sequence Number Match, preferably 0.6; ω1 and ω2 can be appropriately allocated or selected according to actual conditions;

[0118] S4 is assigned a value using the following formula:

[0119]

[0120]

[0121]

[0122]

[0123]

[0124]

[0125]

[0126]

[0127]

[0128] Where δ1 is the weight associated with D_PLR; D_PLR is the average packet loss rate of the xth IPv6 address in address binding pool Pool2 Average packet loss rate of the yth IPv6 address in address binding pool Pool2 The difference between; is the packet loss rate of the i-th PING test for an IPv6 address in address binding pool Pool2; Number of Lost Packets is the number of lost packets; Total Number of Sent Packets is the total number of sent packets; δ2 is the weight related to D_ICMPER; D_ICMPER is the average ICMP error rate of the x-th IPv6 address in address binding pool Pool2 Average ICMP error rate of the yth IPv6 address in address binding pool Pool2 The difference between is the ICMP error rate when performing the i-th PING test on an IPv6 address in address binding pool Pool2; Number of ICMP Errors is the number of ICMP errors; Total Number of ICMP Massages is the total number of ICMP messages; δ3 is the weight related to D_AMS; D_AMS is the average message size of the x-th IPv6 address in address binding pool Pool2 Average message size for the yth IPv6 address in address binding pool Pool2 The difference between It is the size of the reply packet when the i-th PING test is performed on a certain IPv6 address in the address binding pool Pool2; wherein AMS is the abbreviation of Average Message Size. Among them, δ1, δ2 and δ3 can be selected and adjusted according to the importance of each feature to S4. In the present invention, it is preferred that δ1=30, δ2=35, and δ3=45.

[0129] In the present invention, the preset time threshold is 48 hours, because: the terminal shutdown will cause the ping to fail, that is, there is no response to the terminal ping test, or the default generation cycle of the temporary IPv6 address is 24 hours. If the IPv6 address stored in the binding information Bindings4 in the address binding pool Pool3 survives for more than 24 hours, or has multiple survival records within 48 hours, or survives all the time, the IPv6 address is marked as a fixed IPv6 address.

[0130] Since a temporary IPv6 address is unreachable after it expires, if the IPv6 address determined to be a temporary address appears again in address binding pool Pool3, it proves that the IPv6 address belongs to the category of fixed IP addresses. At this time, the IPv6 address should be marked as a fixed address.

[0131] Based on the above temporary IPv6 address terminal identification method, correspondingly, this example also provides a computer-readable storage medium storing a computer program, and when the computer program is executed by a processor, the following steps are implemented: real-time collection of IPv6 traffic and parsing of data packets in the IPv6 traffic, collecting the source IPv6 address, the MAC address corresponding to the source IPv6 address, the destination IPv6 address, and the MAC address corresponding to the destination IPv6 address, and then filtering the IPv6 addresses collected according to the known IPv6 address prefix, retaining the IPv6 addresses containing the IPv6 address prefix, generating a unique user ID for each retained IPv6 address, and then binding the user ID, MAC address and IPv6 address to form binding information Bindings0, and adding the binding information Bindings0 to the address binding pool Pool1, performing periodic PING tests on the IPv6 addresses in the address binding pool Pool1, and if a certain IPv6 address cannot be PINGed within a preset time threshold T1, discarding the binding information Bindings0 containing the IPv6 address, and judging the binding information B retained after processing. Whether the MAC addresses in indings0 are the same, for multiple user IDs sharing the same MAC address, retain the user ID with the smallest consecutive number in the user ID identifier and generate binding information Bindings1, then add the binding information Bindings1 and the retained binding information Bindings0 to the address binding pool Pool2 and mark it as binding information Bindings2, determine whether the MAC address in the binding information Bindings2 belongs to the same terminal, if it belongs to the same terminal, retain the user ID with the smallest consecutive number in the user ID identifier and generate binding information Bindings3, otherwise, retain the binding information Bindings2, then add the binding information Bindings3 and the retained binding information Bindings2 to the address binding pool Pool3 and mark it as binding information Bindings4, perform a periodic PING test on the IPv6 address in the binding information Bindings4, when a certain IPv6 address is inactivated within the preset time threshold T2, the IPv6 address is a temporary IPv6 address, otherwise, the IPv6 address is a fixed IPv6 address.

[0132] like Figure 4As shown, based on the above temporary IPv6 address terminal identification method and computer-readable storage medium, in this embodiment, a computer device is also provided, which includes a readable storage medium, a processor, and a computer program stored on the readable storage medium and executable on the processor, wherein the readable storage medium and the processor are both arranged on a bus, and when the processor executes the computer program, the following steps are implemented: real-time collection of IPv6 traffic and parsing of data packets in the IPv6 traffic, collection of source IPv6 addresses, MAC addresses corresponding to the source IPv6 addresses, destination IPv6 addresses, and MAC addresses corresponding to the destination IPv6 addresses, and then according to known The collected IPv6 addresses are filtered by the IPv6 address prefix, and the IPv6 addresses containing the IPv6 address prefix are retained. A unique user ID is generated for each retained IPv6 address, and then the user ID, MAC address and IPv6 address are bound to form binding information Bindings0, and the binding information Bindings0 is added to the address binding pool Pool1. The IPv6 addresses in the address binding pool Pool1 are periodically PING tested. If an IPv6 address cannot be PINGed within the preset time threshold T1, the IPv6 address containing the IPv6 address is discarded. Binding information Bindings0, determine whether the MAC addresses in the binding information Bindings0 that remain after processing are the same. For multiple user IDs that share the same MAC address, retain the user ID with the smallest consecutive number in the user ID identifier and generate binding information Bindings1, then add binding information Bindings1 and the retained binding information Bindings0 to the address binding pool Pool2 and identify them as binding information Bindings2, determine whether the MAC addresses in binding information Bindings2 belong to the same terminal, if they belong to the same terminal, retain them. The user ID with the smallest consecutive numbers in the user ID identification is retained and binding information Bindings3 is generated. Otherwise, binding information Bindings2 is retained, and then binding information Bindings3 and retained binding information Bindings2 are added to address binding pool Pool3 and marked as binding information Bindings4. Periodic PING tests are performed on the IPv6 addresses in binding information Bindings4. When an IPv6 address is inactivated within the preset time threshold T2, the IPv6 address is a temporary IPv6 address. Otherwise, the IPv6 address is a fixed IPv6 address.

[0133] Obviously, the above embodiments are merely examples for the purpose of clear explanation, and are not intended to limit the implementation methods. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the implementation methods here. The obvious changes or modifications derived therefrom are still within the scope of protection of the claims of this patent application.

Claims

1. A temporary IPv6 address terminal identification method, characterized in that: The steps include: S1) Collect IPv6 traffic in real time and parse the data packets in the IPv6 traffic, collect the source IPv6 address, the MAC address corresponding to the source IPv6 address, the destination IPv6 address and the MAC address corresponding to the destination IPv6 address; S2) filtering the IPv6 addresses collected in step S1) according to the known IPv6 address prefixes, and retaining the IPv6 addresses containing the IPv6 address prefixes; S3) generating a unique user ID for each IPv6 address retained in step S2), and then binding the user ID, MAC address and IPv6 address to form binding information Bindings0, and adding the binding information Bindings0 to the address binding pool Pool1; wherein the user ID contains a continuous number of preset digits; in the binding information Bindings0, there is a mapping relationship between the user ID, MAC address and IPv6 address; S4) Perform periodic PING tests on the IPv6 addresses in the address binding pool Pool1. If a certain IPv6 address cannot be PINGed within the preset time threshold T1, the binding information Bindings0 containing the IPv6 address is discarded. S5) performs a summative judgment on the binding information Bindings0 that remains after being processed in step S4), and the specific steps are as follows: S5-1) determining whether the MAC addresses in the binding information Bindings0 retained after the processing in step S4) are the same, for multiple user IDs that share the same MAC address, retain the user ID with the smallest consecutive number in the user ID identifier and generate binding information Bindings1, then add the binding information Bindings1 and the retained binding information Bindings0 to the address binding pool Pool2 and identify them as binding information Bindings2; S5-2) Determine whether the MAC addresses in the binding information Bindings2 belong to the same terminal. If they belong to the same terminal, retain the user ID with the smallest consecutive digits in the user ID and generate the binding information Bindings3. Otherwise, retain the binding information Bindings2, then add the binding information Bindings3 and the retained binding information Bindings2 to the address binding pool Pool3 and mark them as binding information Bindings4; wherein, in the binding information Bindings1, the binding information Bindings2, the binding information Bindings3 and the binding information Bindings4, there is a mapping relationship between the user ID, the MAC address and the IPv6 address; S6) Perform periodic PING tests on the IPv6 addresses in the binding information Bindings4. When an IPv6 address is inactivated within a preset time threshold T2, the IPv6 address is a temporary IPv6 address. Otherwise, the IPv6 address is a fixed IPv6 address. The preset time threshold is 48 hours.

2. The temporary IPv6 address terminal identification method according to claim 1, characterized in that: In step S5-2), whether the two MAC addresses belong to the same terminal is determined by the following method: Send ICMPV6 data packets to all IPv6 addresses in address binding pool Pool2, obtain the TTL value, ICMP response time, ICMP identifier and sequence number, and ICMP message behavior characteristics of the return packet, and assign values ​​to the TTL value, ICMP response time, ICMP identifier and sequence number, and ICMP message behavior characteristics of the return packet. Then, calculate the difference score of the return packets of any two IPv6 addresses based on the assigned TTL value, ICMP response time, ICMP identifier and sequence number, and ICMP message behavior characteristics. If the calculated difference score is greater than the threshold, it is determined that the terminals using the two IPv6 addresses are the same terminal. Otherwise, it is determined that the terminals using the two IPv6 addresses are not the same terminal.

3. The temporary IPv6 address terminal identification method according to claim 2, characterized in that: In step S5-2), the difference score is calculated by the following formula: Where, W1 is the weight of the TTL value difference score; S1 is the TTL value difference score; W2 is the weight of the ICMP response time difference score; S2 is the ICMP response time difference score; W3 is the weight of the ICMP identifier and sequence number difference score; S3 is the ICMP identifier and sequence number difference score; W4 is the weight of the ICMP message behavior feature difference score; S4 is the ICMP message behavior feature difference score.

4. The temporary IPv6 address terminal identification method according to claim 3, characterized in that: S1 is calculated by the following formula: Where, e is a natural constant; HOP - It is the difference of the average number of hops after two data packets reach the destination, and its value range is an integer greater than or equal to 0; To obtain the average TTL value after N-times evaluation of the x-th IPv6 address in address binding pool Pool2; The average TTL value is obtained after N evaluations are performed on the yth IPv6 address in address binding pool Pool2; N is a natural number greater than or equal to 3; S2 is assigned a value using the following formula: Where D_RT is the difference between the average ICMP response time of the x-th IPv6 address in address binding pool Pool2 and the average ICMP response time of the y-th IPv6 address in address binding pool Pool2, which is a positive number; ICMP_RT is the average ICMP response time obtained after N PING measurements, in milliseconds; is the response time of the i-th PING timing request; The sending time of the i-th PING timing request; S3 is assigned by the following formula: In the formula, Identifier Match is the identifier matching degree, and Identifier Match is determined according to the following rules: If the ICMP identifiers of the two IPv6 address packets are exactly the same, the Identifier Match value is 1; if the ICMP identifiers of the two IPv6 address packets are partially matched or the same or comply with the same policy, the Identifier Match value range is (0, 1); if the ICMP identifiers of the two IPv6 address packets are completely inconsistent, the Identifier Match value is 0; Sequence Number Match is the sequence number matching degree. Sequence Number Match takes values ​​according to the following rules: If the ICMP sequence numbers of the two IPv6 addresses are exactly the same, the Sequence Number Match value is 1; if the ICMP sequence numbers of the two IPv6 addresses are partially matched or the same or comply with the same policy, the Sequence Number Match value range is (0, 1); if the ICMP sequence numbers of the two IPv6 addresses are completely inconsistent, the Sequence Number Match value is 0; ω1 is the weight of Identifier Match, ω2 is the weight of Sequence Number Match; S4 is assigned a value using the following formula: Where δ1 is the weight associated with D_PLR; D_PLR is the average packet loss rate of the xth IPv6 address in address binding pool Pool2 Average packet loss rate of the yth IPv6 address in address binding pool Pool2 The difference between; is the packet loss rate of the i-th PING test for an IPv6 address in address binding pool Pool2; Number of LostPackets is the number of lost packets; Total Number of Sent Packets is the total number of sent packets; δ2 is the weight related to D_ICMPER; D_ICMPER is the average ICMP error rate of the x-th IPv6 address in address binding pool Pool2 Average ICMP error rate of the yth IPv6 address in address binding pool Pool2 The difference between The ICMP error rate when performing the i-th PING test on an IPv6 address in address binding pool Pool2; Number of ICMPErrors is the number of ICMP errors; Total Number of ICMP Massages is the total number of ICMP messages; δ3 is the weight related to D_AMS; D_AMS is the average message size of the x-th IPv6 address in address binding pool Pool2 Average message size for the yth IPv6 address in address binding pool Pool2 The difference between It is the size of the reply packet when the i-th PING test is performed on an IPv6 address in address binding pool Pool2.

5. The temporary IPv6 address terminal identification method according to claim 1, characterized in that: The periodic PING test is performed every thirty minutes.

6. A system for terminal identification using the temporary IPv6 address terminal identification method according to claim 1, characterized in that: include: A data collection unit is used to collect IPv6 traffic and parse the data packets in the IPv6 traffic and collect the source IPv6 address, the MAC address corresponding to the source IPv6 address, the destination IPv6 address and the MAC address corresponding to the destination IPv6 address; A data processing unit, used for filtering the IPv6 addresses obtained by the data collection unit according to the known IPv6 address prefix and retaining the IPv6 addresses containing the IPv6 address prefix; A user ID generation unit, used to generate a unique user ID for each retained IPv6 address; A binding unit, used to bind an IPv6 address with a related MAC address and a user ID; An address binding pool, used to store binding information. The address binding pool includes address binding pool Pool1, address binding pool Pool2 and address binding pool Pool3. Among them, address binding pool Pool1 is used to store binding information Bindings0, address binding pool Pool2 is used to store binding information Bindings2, and address binding pool Pool3 is used to store binding information Bindings4; IPv6 address PING test unit, used to perform indirect PING test on IPv6 addresses in the address binding pool; The summing and distinguishing unit is used to distinguish the same MAC address and the same user of the IPv6 addresses in the address binding pool and output the distinguishing result; An IPv6 address determination unit is used to determine whether the IPv6 address in the output result of the summary determination unit is a temporary IPv6 address; The data acquisition unit is communicatively connected to the data processing unit, the data processing unit is communicatively connected to the user ID identification generation unit and the binding unit respectively, the binding unit is communicatively connected to the address binding pool Pool1, the address binding pool Pool1 is communicatively connected to the IPv6 address PING measurement unit and the summary determination unit respectively, the IPv6 address PING measurement unit is communicatively connected to the summary determination unit, the summary determination unit is communicatively connected to the address binding pool Pool2 and the address binding pool Pool3 respectively, and the address binding pool Pool3 is communicatively connected to the IPv6 address determination unit.

7. The system according to claim 6, characterized in that The summing-up and determination unit comprises a TTL value analysis and calculation module, an ICMP response time analysis and calculation module, an ICMP identifier and sequence number analysis and calculation module, an ICMP message behavior characteristic analysis and calculation module, a comprehensive calculation analysis and determination module and a summing-up and binding module. The summing-up and binding module is in communication connection with the comprehensive calculation analysis and determination module. The comprehensive calculation analysis and determination module is in communication connection with the TTL value analysis and calculation module, the ICMP response time analysis and calculation module, the ICMP identifier and sequence number analysis and calculation module and the ICMP message behavior characteristic analysis and calculation module respectively. Among them, the TTL value analysis and calculation module is used to calculate the value related to the TTL of the IPv6 address according to the PING measurement result of the IPv6 address in the address binding pool by the IPv6 address PING measurement unit, and the ICMP response time analysis and calculation module is used to calculate the value related to the ICMP response time of the IPv6 address according to the PING measurement result of the IPv6 address in the address binding pool by the IPv6 address PING measurement unit. The ICMP identifier and sequence number analysis and calculation module is used to calculate the numerical value related to the ICMP identifier and sequence number of the IPv6 address according to the PING measurement result of the IPv6 address in the address binding pool by the IPv6 address PING measurement unit; the ICMP message behavior feature analysis and calculation module is used to calculate the numerical value related to the ICMP message behavior feature of the IPv6 address according to the PING measurement result of the IPv6 address in the address binding pool by the IPv6 address PING measurement unit; the comprehensive calculation and analysis judgment module is used to perform comprehensive calculation based on the results output by the TTL value analysis and calculation module, the ICMP response time analysis and calculation module, the ICMP identifier and sequence number analysis and calculation module, and the ICMP message behavior feature analysis and calculation module, and to perform the same MAC address and the same user attribution judgment on the IPv6 addresses in the address binding pool; the attribution binding module is used to bind the IPv6 address with the corresponding MAC address and the user ID according to the judgment result output by the comprehensive calculation and analysis judgment module.

8. The system according to claim 6, characterized in that It also includes a liveness detection unit for periodically detecting the liveness status of the IP address, and the liveness detection unit is communicatively connected with the IP address determination unit.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the temporary IPv6 address terminal identification method according to any one of claims 1 to 5 is implemented.

10. A computer device comprising a readable storage medium, a processor, and a computer program stored on the readable storage medium and executable on the processor, characterized in that: When the computer program is executed by a processor, the temporary IPv6 address terminal identification method according to any one of claims 1 to 5 is implemented.

Images