Active IPv6 address prediction method based on big data and related device

Abstract

The embodiment of the invention relates to the technical field of deep learning and big data, and provides an active IPv6 address prediction method based on big data and a related device, and the method comprises the steps: obtaining an IPv6 address set of a user and IPv6 address data corresponding to an IPv6 address in the IPv6 address set, and carrying out the data cleaning of the IPv6 address data, and obtaining target IPv6 address data; key features are extracted from the target IPv6 address data, the key features comprise a related combination feature, a cross feature, a category feature and a time feature, and an original IPv6 address is processed by adopting a hash function to obtain an original feature; the key features and the original features are combined with the cross network to perform active address prediction, the key features in the address data can be extracted, the cross model is adopted to perform operation and prediction to obtain the prediction result, and the accuracy of activity prediction is improved.

Description

Technical Field

[0001] The present invention relates to the field of deep learning and big data technology, and in particular to a method and related device for predicting active IPv6 addresses based on big data. Background Art

[0002] In recent years, the global adoption of IPv6 addresses has gradually increased, but the exact status of its active address forecast may be affected by region, organization and industry. With the sharp increase in Internet devices, the larger address space provided by IPv6 has become one of the key means to solve the problem of IPv4 address exhaustion.

[0003] The promotion of IPv6 has made some progress around the world, with some governments, Internet service providers and enterprises gradually adopting IPv6 and implementing relevant support in their network infrastructure. Many Internet service providers have deployed IPv6 in their networks and provide support for IPv6. This helps drive the adoption of IPv6 by users and enterprises, as their devices can be compatible with networks that provide IPv6 support. In order to promote the global adoption of IPv6, some organizations and standards bodies have collaborated at the international level. This collaboration helps to develop common IPv6 adoption standards and promote joint efforts of the global Internet community. As more devices are connected to the Internet, the adoption of IPv6 is expected to continue to increase. Emerging technologies, such as the Internet of Things (IoT) and 5G networks, will require IPv6, which may further promote its global adoption.

[0004] However, there are still differences in the degree of IPv6 adoption around the world, and there are mainly the following problems in predicting the activity level of some global IPv6 addresses: first, traditional prediction methods are difficult to capture the time series information of the activity level of existing IPv6 addresses; second, it is impossible to capture the relationship between traditional features in the time dimension; third, the IPv6 address space is large, and the activity level of addresses is difficult to predict in a short period of time, while traditional methods cannot predict the activity level of addresses in the case of long time series. Summary of the invention

[0005] The embodiments of the present application provide an active IPv6 address prediction method and related devices based on big data, which can extract key features in the address data, and use a cross model for calculation and prediction to obtain prediction results, thereby improving the accuracy of activity prediction.

[0006] A first aspect of an embodiment of the present application provides a method for predicting active IPv6 addresses based on big data, the method comprising:

[0007] Acquire the user's IPv6 address set, and the IPv6 address data corresponding to the IPv6 address in the IPv6 address set, and perform data cleaning on the IPv6 address data to obtain target IPv6 address data;

[0008] Extracting key features from the target IPv6 address data, the key features including relevant combination features, cross features, category features and time features, and processing the original IPv6 address using a hash function to obtain original features;

[0009] The original features are input into the LG cross model for operation to obtain GRU_OUT, LSTM OUT , and input the key features into the LG cross model for calculation to obtain BatchNormal_OUT_1 and BatchNormal_OUT_2;

[0010] GRU_OUT, LSTM_OUT, BatchNormal_OUT_1 and BatchNormal_OUT_2 are input into the fully connected layer for operation to obtain GRU_OUT′, LSTM_OUT′, BatchNormal_OUT_1′ and BatchNormal_OUT_2′;

[0011] GRU_OUT′, LSTM_OUT′, BatchNormal_OUT_1′ and BatchNormal_OUT_2′ are fused with weights of 0.3, 0.3, 0.2, and 0.2 respectively, and the final output is the result;

[0012] Active address prediction is performed according to the final output result.

[0013] In this example, the user's IPv6 address set and the IPv6 address data corresponding to the IPv6 address in the IPv6 address set are obtained, and the IPv6 address data is cleaned to obtain the target IPv6 address data; key features are extracted from the target IPv6 address data, and the key features include related combination features, cross features, category features and time features, and the original IPv6 address is processed using a hash function to obtain the original features; the original features are input into the LG cross model for operation to obtain GRU_OUT, LSTM OUT, and input the key features into the LG cross model for calculation to obtain BatchNormal_OUT_1 and BatchNormal_OUT_2; input GRU_OUT, LSTM_OUT, BatchNormal_OUT_1 and BatchNormal_OUT_2 into the fully connected layer for calculation to obtain GRU_OUT′, LSTM_OUT′, BatchNormal_OUT_1′ and BatchNormal_OUT_2′; GRU_OUT′, LSTM_OUT′, BatchNormal_OUT_1′ and BatchNormal_OUT_2′ are fused according to weights of 0.3, 0.3, 0.2, and 0.2, respectively, and finally the result is output; active address prediction is performed according to the final output result, therefore, the key features in the address data can be extracted, and the cross model is used for calculation and prediction to obtain the prediction result, thereby improving the accuracy of activity prediction.

[0014] A second aspect of an embodiment of the present application provides an active IPv6 address prediction device based on big data, the device comprising:

[0015] An acquisition unit is used to acquire a user's IPv6 address set and IPv6 address data corresponding to the IPv6 address in the IPv6 address set, and to clean the IPv6 address data to obtain target IPv6 address data;

[0016] An extraction unit is used to extract key features from the target IPv6 address data, wherein the key features include related combination features, cross features, category features and time features, and process the original IPv6 address using a hash function to obtain the original features;

[0017] The first operation unit is used to input the original features into the LG cross model for operation to obtain GRU_OUT, LSTM OUT , and input the key features into the LG cross model for calculation to obtain BatchNormal_OUT_1 and BatchNormal_OUT_2;

[0018] The second operation unit is used to input GRU_OUT, LSTM_OUT, BatchNormal_OUT_1 and BatchNormal_OUT_2 into the fully connected layer for operation to obtain GRU_OUT′, LSTM_OUT′, BatchNormal_OUT_1′ and BatchNormal_OUT_2′;

[0019] The fusion unit is used to fuse GRU_OUT′, LSTM_OUT′, BatchNormal_OUT_1′ and BatchNormal_OUT_2′ with weights of 0.3, 0.3, 0.2 and 0.2 respectively, and finally output the result;

[0020] A prediction unit is used to predict the active address according to the final output result.

[0021] A third aspect of an embodiment of the present application provides a terminal, comprising a processor, an input device, an output device and a memory, wherein the processor, input device, output device and memory are interconnected, wherein the memory is used to store a computer program, the computer program comprises program instructions, and the processor is configured to call the program instructions to execute the step instructions in the first aspect of the embodiment of the present application.

[0022] The fourth aspect of the embodiments of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program for electronic data exchange, wherein the computer program enables a computer to execute part or all of the steps described in the first aspect of the embodiments of the present application.

[0023] A fifth aspect of the embodiments of the present application provides a computer program product, wherein the computer program product includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to execute some or all of the steps described in the first aspect of the embodiments of the present application. The computer program product may be a software installation package. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0025] Figure 1 A flowchart of a method for predicting active IPv6 addresses based on big data is provided for an embodiment of the present application;

[0026] Figure 2 A schematic diagram of the structure of a terminal provided in an embodiment of the present application;

[0027] Figure 3 A structural schematic diagram of an active IPv6 address prediction device based on big data is provided for an embodiment of the present application. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0029] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0030] Reference to "embodiments" in this application means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described in this application may be combined with other embodiments.

[0031] Figure 1 A flowchart of a method for predicting active IPv6 addresses based on big data is provided for an embodiment of the present application. The method for predicting active IPv6 addresses based on big data includes:

[0032] 101. Obtain a user's IPv6 address set and IPv6 address data corresponding to the IPv6 address in the IPv6 address set, and perform data cleaning on the IPv6 address data to obtain target IPv6 address data.

[0033] The IPv6 address set includes the IPv6 Hitlist data of the open source address set obtained for consecutive days. The required daily data is obtained by using the tool Zmapv6 to scan some ports of the obtained open source address set IPv6 Hitlist data, such as ICMPv6, TCP / 80, TCP / 443, UDP / 53, and UDP / 443. If the obtained address is queried using any of the above scanning methods and a response is obtained, the address will be marked as active. Then the data is cleaned. The data cleaning process includes:

[0034] The target IPv6 address data is sorted in the order of acquisition time to obtain a first data sequence; the target IPv6 address data is extracted from the first data sequence, and the target IPv6 address is the data in the IPv6 address data except for missing values ​​and abnormal values.

[0035] Specifically, the target IPv6 address data can be sorted in chronological order; then, check whether there are missing values ​​in the target IPv6 address data, and delete them if there are; check whether the target IPv6 address data is an abnormal value, that is, the data format does not conform to the IPv6 format, and delete them if there are, and finally obtain the target IPv6 address data.

[0036] 102. Extract key features from the target IPv6 address data, wherein the key features include related combination features, cross features, category features, and time features, and process the original IPv6 address using a hash function to obtain original features.

[0037] The original IPv6 address is processed using the following formula to obtain the original feature:

[0038] MappedValue=PEP(InputData)mod Range,

[0039] Among them, PEP is a hash function that maps the input data to a 512-bit hash value, mod means modulus, and the value of Range is 13331. The details are as follows:

[0040] Preprocessing, first, pad the input data to ensure that its length is a multiple of 512 bits. During the padding process, the data is first represented in binary form to obtain M. Then, an ASCII code value (binary representation) of a random letter from a to z is appended to M, and then a sufficient number of 0s are added until the length of M (in bits) satisfies len(M)%512=0. Finally, a 64-bit integer (binary representation) is appended to the end to represent the length of the original message (in bits), and finally M` is obtained. The overall formula can be expressed as:

[0041] M`=Pad(M),

[0042] Initialization constants, using random initialization of 32 fixed 32-bit unsigned integers, denoted as h0, h1, ..., h 32 , these constants are used in the subsequent block processing function. In order to prevent conflicts caused by hash function processing, they are set to the first 32 bits of the decimal part of the square root of the first 32 prime numbers in natural numbers;

[0043] Block processing: divide the padded message M` into 512-bit blocks. Each 512-bit block is divided into 16 sub-blocks, for a total of 32 sub-blocks. Then, each sub-block is processed from left to right. The formula is:

[0044]

[0045] In the above formula, RightRound(M′[i], 2 i ), which means to circularly shift the i-th block of M′ to the right by 2 i Locations, represents bitwise exclusive OR, It means directly concatenating the results of these 32 sub-blocks. This process can be recorded as:

[0046] ProcessBlocks(M`[i]),

[0047] Therefore, the above PEP hash function can be expressed as:

[0048] PEP(InputData)=ProcessBlocks(Pad(InputData)).

[0049] The method for extracting key features from the target IPv6 address data may be performed using a general feature extraction method, etc., to obtain key features.

[0050] 103. Input the original features into the LG cross model for operation to obtain GRU_OUT, LSTM OUT , and input the key features into the LG cross model for calculation to obtain BatchNormal_OUT_1 and BatchNormal_OUT_2.

[0051] Among them, the key features are input into GRU2 and LSTM2 of the LG cross model for calculation to obtain outputs OUT1 and OUT2; OUT1 and OUT2 are concatenated in two ways, OUT1+OUT2 and OUT2+OUT1, respectively, and then input into the BatchNormal layer of the LG cross model for calculation to obtain BatchNormal_OUT_1 and BatchNormal_OUT_2.

[0052] Specifically, the calculations involved in the LSTM2 layer are as follows:

[0053] f t =σ(W f ·[h t-1 , x t ]+b f ),

[0054] i t =σ(W i ·[h t-1 , x t ]+b i ),

[0055]

[0056] o t =σ(W o ·[h t-1 , x t ]+b o ),

[0057] In the above formula, f t Represents the data result of the forget gate, i t Indicates the input data results, represents the candidate value for memory update, o t Represents the data result of the output gate, W f , W i , W c , W o represents the weight matrix, b f , b i , b c , b o represents the bias term, [h t-1 , x i ] means to hide the state h t-1 With input x i Splicing is performed in the horizontal direction, σ represents the sigmoid function, and tanh represents the tangent function.

[0058] According to the above calculation results, the memory unit c can be further updated t and the hidden layer state h t , and its calculation formula is:

[0059]

[0060] h t =o t ·tanh(c t ),

[0061] Among them, the calculations involved in the GRU layer are as follows:

[0062] z t =σ(W z ·[h t-1 , x t ]),

[0063] r t =σ(Wr ·[h t-1 , x t ]),

[0064]

[0065] Among them, z t represents the operation result of the update gate, r t Represents the operation result of the reset gate, Indicates the running result of the current memory content, h t Represents the final memory result of the current time step, W z , W r , W represents the weight matrix, [h t-1 , x i ] means to hide the state h t-1 With input x i Splicing is performed in the horizontal direction, σ represents the sigmoid function, and tanh represents the tangent function.

[0066] 104. Input GRU_OUT, LSTM_OUT, BatchNormal_OUT_1 and BatchNormal_OUT_2 into the fully connected layer for operation to obtain GRU_OUT′LSTM_OUT′, BatchNormal_OUT_1′ and BatchNormal_OUT_2′.

[0067] Among them, the fully connected layer includes the first fully connected layer FC1 and the second fully connected layer FC2. The specific operation is as follows:

[0068] Among them, the calculations involved in the first fully connected layer FC1 are as follows:

[0069] Z = ReLU(X·W1+b1)·W2+b2,

[0070] According to the above formula, FC1 involves two fully connected layers, where W1, b1 and W2, b2 represent the weights and bias terms of the first and second layers respectively, ReLU represents the activation function, X represents the input data, and Z represents the output result.

[0071] The calculations involved in the second fully connected layer FC2 are as follows:

[0072] Z=ReLU(Dropout(X·W1+b1)·W2+b2)·W3+b3,

[0073] According to the above formula, FC2 involves three fully connected layers, where W1, b1, W2, b2 and W3, b3 represent the weights and bias items of the first, second and third layers respectively, ReLU represents the activation function, Dropout represents the Dropout layer, which is used to randomly set the input elements to zero with probability p during training, X represents the input data, and Z represents the output result.

[0074] 105. GRU_OUT′, LSTM_OUT′, BatchNormal_OUT_1′ and BatchNormal_OUT_2′ are fused with weights of 0.3, 0.3, 0.2, and 0.2 respectively, and the final output is the result.

[0075] Among them, the weight fusion processing is performed by the method shown in the following formula:

[0076] OUT=0.3×GRU_OUT′+0.3×LSTM_OUT′+0.2×BatchNormal_OUT_1′+0.2×BatchNormal_OUT_2′,

[0077] Among them, OUT is the final output result.

[0078] 106. Perform active address prediction according to the final output result.

[0079] The prediction can be made based on the value of the final result. The mapping relationship between the preset value and the activity can be used to determine the corresponding activity based on the value in the final result. When the activity is higher than the activity threshold, the address is determined to be an active address.

[0080] After the technical solution of the embodiment of the present application is implemented, the following effects can be achieved:

[0081] 1. The present invention uses the LSTM+GRU cross structure inside the model, which can fully learn the information of data in a long time series and increase the accuracy of long-term prediction of IPv6 address activity;

[0082] 2. In view of the defect that traditional methods cannot learn time series information, the present invention combines the extraction of traditional key features with time series features, adds time series information to traditional prediction methods, and helps to improve the accuracy and reliability of prediction of IPv6 address activity;

[0083] 3. The present invention extracts traditional key features and imports them into LSTM and GRU for learning respectively, and then cross-processes them, thereby enhancing the learning effect of traditional features;

[0084] 4. In the network structure constructed by the present invention, the BatchNormal layer is introduced for the learning of traditional key features, which speeds up the training speed and improves the stability and robustness of the network.

[0085] 5. The PEP hash function of the present invention maps the input IP address to a 512-bit hash value. At the same time, when filling the data, an ASCII code value (binary representation) of a random letter from a to z is appended after M to increase the complexity of filling, enhance the security of the data, reduce the probability of conflict after data mapping, and improve the accuracy of the final prediction probability.

[0086] For the above embodiments, please refer to Figure 2 , Figure 2 A schematic diagram of the structure of a terminal provided in an embodiment of the present application, as shown in the figure, includes a processor, an input device, an output device and a memory, the processor, the input device, the output device and the memory are interconnected, wherein the memory is used to store a computer program, the computer program includes program instructions, the processor is configured to call the program instructions, and the program includes instructions for executing the following steps;

[0087] Acquire the user's IPv6 address set, and the IPv6 address data corresponding to the IPv6 address in the IPv6 address set, and perform data cleaning on the IPv6 address data to obtain target IPv6 address data;

[0088] Extracting key features from the target IPv6 address data, the key features including relevant combination features, cross features, category features and time features, and processing the original IPv6 address using a hash function to obtain original features;

[0089] The original features are input into the LG cross model for operation to obtain GRU_OUT, LSTM OUT , and input the key features into the LG cross model for calculation to obtain BatchNormal_OUT_1 and BatchNormal_OUT_2;

[0090] GRU_OUT, LSTM_OUT, BatchNormal_OUT_1 and BatchNormal_OUT_2 are input into the fully connected layer for operation to obtain GRU_OUT′, LSTM_OUT′, BatchNormal_OUT_1′ and BatchNormal_OUT_2′;

[0091] GRU_OUT′, LSTM_OUT′, BatchNormal_OUT_1′ and BatchNormal_OUT_2′ are fused with weights of 0.3, 0.3, 0.2, and 0.2 respectively, and the final output is the result;

[0092] Active address prediction is performed according to the final output result.

[0093] The above mainly introduces the scheme of the embodiment of the present application from the perspective of the execution process on the method side. It is understandable that in order to realize the above functions, the terminal includes a hardware structure and / or software module corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments provided herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0094] The embodiment of the present application can divide the terminal into functional units according to the above method example. For example, each functional unit can be divided according to each function, or two or more functions can be integrated into one processing unit. The above integrated unit can be implemented in the form of hardware or in the form of software functional units. It should be noted that the division of units in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0095] In line with the above, see Figure 3 , Figure 3 The present application provides a schematic diagram of a structure of an active IPv6 address prediction device based on big data. Figure 3 As shown, the device comprises:

[0096] The acquisition unit 401 is used to acquire the user's IPv6 address set and the IPv6 address data corresponding to the IPv6 address in the IPv6 address set, and clean the IPv6 address data to obtain the target IPv6 address data;

[0097] An extraction unit 402 is used to extract key features from the target IPv6 address data, wherein the key features include related combination features, cross features, category features, and time features, and process the original IPv6 address using a hash function to obtain the original features;

[0098] The first operation unit 403 is used to input the original features into the LG cross model for operation to obtain GRU_OUT, LSTM OUT , and input the key features into the LG cross model for calculation to obtain BatchNormal_OUT_1 and BatchNormal_OUT_2;

[0099] The second operation unit 404 is used to input GRU_OUT, LSTM_OUT, BatchNormal_OUT_1 and BatchNormal_OUT_2 into the fully connected layer for operation to obtain GRU_OUT′, LSTM_OUT′, BatchNormal_OUT_1′ and BatchNormal_OUT_2′;

[0100] A fusion unit 405 is used to fuse GRU_OUT′, LSTM_OUT′, BatchNormal_OUT_1′ and BatchNormal_OUT_2′ according to weights of 0.3, 0.3, 0.2 and 0.2 respectively, and finally output the result;

[0101] The prediction unit 406 is used to predict the active address according to the final output result.

[0102] In a possible implementation, the IPv6 address set includes addresses in open source address sets for multiple consecutive days;

[0103] In the aspect of performing data cleaning on the IPv6 address data to obtain the target IPv6 address data, the acquisition unit 401 is specifically used for:

[0104] Sorting the target IPv6 address data in the order of acquisition time to obtain a first data sequence;

[0105] Target IPv6 address data is extracted from the first data sequence, where the target IPv6 address is data in the IPv6 address data excluding missing values ​​and abnormal values.

[0106] In a possible implementation, in the aspect of using a hash function to process the original IPv6 address to obtain the original feature, the extraction unit 402 is specifically used to:

[0107] The original IPv6 address is processed using the method shown in the following formula to obtain the original features:

[0108] MappedValue=PEP(InputData)mod Range,

[0109] Among them, PEP is a hash function that maps the input data to a 512-bit hash value, mod means modulus, and the value of Range is 13331.

[0110] In a possible implementation, in inputting the key features into the LG cross model for operation to obtain BatchNormal_OUT_1 and BatchNormal_OUT_2, the first operation unit 403 is specifically used to:

[0111] The key features are input into GRU2 and LSTM2 of the LG cross model for operation to obtain outputs OUT1 and OUT2;

[0112] OUT1 and OUT2 are concatenated in the two modes of OUT1+OUT2 and OUT2+OUT1 respectively, and then input into the BatchNormal layer of the LG cross model for calculation to obtain BatchNormal_OUT_1 and BatchNormal_OUT_2.

[0113] In a possible implementation, the fusion unit 405 is specifically configured to:

[0114] The weight fusion process is performed by the method shown in the following formula:

[0115] OUT=0.3×GRU_OUT′+0.3×LSTM_OUT′+0.2×BatchNormal_OUT_1′+0.2×BatchNormal_OUT_2′

[0116] Among them, OUT is the final output result.

[0117] An embodiment of the present application also provides a computer storage medium, wherein the computer storage medium stores a computer program for electronic data exchange, and the computer program enables a computer to execute part or all of the steps of any one of the active IPv6 address prediction methods based on big data as recorded in the above method embodiments.

[0118] An embodiment of the present application also provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program enables a computer to execute part or all of the steps of any one of the active IPv6 address prediction methods based on big data recorded in the above method embodiments.

[0119] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0120] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0121] In the several embodiments provided in the present application, it should be understood that the disclosed device can be implemented in other ways. For example, the device embodiments described above are only schematic, such as the division of the units, which is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the device or unit can be electrical or other forms.

[0122] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0123] In addition, the functional units in the various embodiments of the application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated units may be implemented in the form of hardware or in the form of software program modules.

[0124] If the integrated unit is implemented in the form of a software program module and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a memory, including a number of instructions to enable a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned memory includes: U disk, read-only memory (ROM), random access memory (RAM), mobile hard disk, disk or optical disk and other media that can store program codes.

[0125] A person of ordinary skill in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable memory, which can include: a flash drive, a read-only memory, a random access memory, a magnetic disk or an optical disk, etc.

[0126] The embodiments of the present application are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core idea of ​​the present application. At the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for predicting active IPv6 addresses based on big data, characterized in that: The method comprises: Acquire the user's IPv6 address set, and the IPv6 address data corresponding to the IPv6 address in the IPv6 address set, and perform data cleaning on the IPv6 address data to obtain target IPv6 address data; Extracting key features from the target IPv6 address data, the key features including relevant combination features, cross features, category features and time features, and processing the original IPv6 address using a hash function to obtain original features; The original features are input into the LG cross model for operation to obtain GRU_OUT, LSTM OUT , and input the key features into the LG cross model for calculation to obtain BatchNormal_OUT_1 and BatchNormal_OUT_2; GRU_OUT, LSTM_OUT, BatchNormal_OUT_1 and BatchNormal_OUT_2 are input into the fully connected layer for operation to obtain GRU_OUT′, LSTM_OUT′, BatchNormal_OUT_1′ and BatchNormal_OUT_2′; GRU_OUT′, LSTM_OUT′, BatchNormal_OUT_1′ and BatchNormal_OUT_2′ are fused with weights of 0.3, 0.3, 0.2, and 0.2 respectively, and the final output is the result; Active address prediction is performed according to the final output result.

2. According to the big data-based active IPv6 address prediction method of claim 1, it is characterized in that: The IPv6 address set includes addresses in the open source address set for consecutive days; The step of cleaning the IPv6 address data to obtain the target IPv6 address data includes: Sorting the target IPv6 address data in the order of acquisition time to obtain a first data sequence; Target IPv6 address data is extracted from the first data sequence, where the target IPv6 address is data in the IPv6 address data excluding missing values ​​and abnormal values.

3. The method for predicting active IPv6 addresses based on big data according to claim 2, characterized in that: The original IPv6 address is processed by a hash function to obtain the original features, including: The original IPv6 address is processed using the method shown in the following formula to obtain the original features: MappedValue=PEP(InputData)mod Range, Among them, PEP is a hash function that maps the input data to a 512-bit hash value, mod means modulus, and the value of Range is 13331.

4. The method for predicting active IPv6 addresses based on big data according to claim 2, characterized in that: The key features are input into the LG cross model for operation to obtain BatchNormal_OUT_1 and BatchNormal_OUT_2, including: The key features are input into GRU2 and LSTM2 of the LG cross model for operation to obtain outputs OUT1 and OUT2; OUT1 and OUT2 are concatenated in the two modes of OUT1+OUT2 and OUT2+OUT1 respectively, and then input into the BatchNormal layer of the LG cross model for calculation to obtain BatchNormal_OUT_1 and BatchNormal_OUT_2.

5. The method for predicting active IPv6 addresses based on big data according to any one of claims 1 to 4, characterized in that: The GRU_OUT′, LSTM_OUT′, BatchNormal_OUT_1′ and BatchNormal_OUT_2′ are fused with weights of 0.3, 0.3, 0.2 and 0.2 respectively, and the final output results include: The weight fusion process is performed by the method shown in the following formula: OUT=0.3×GRU_OUT′+0.3×LSTM_OUT′+0.2×BatchNormal_OUT_1′ +0.2×BatchNormal_OUT_2′ Among them, OUT is the final output result.

6. An active IPv6 address prediction device based on big data, characterized in that: The device comprises: An acquisition unit is used to acquire a user's IPv6 address set and IPv6 address data corresponding to the IPv6 address in the IPv6 address set, and to clean the IPv6 address data to obtain target IPv6 address data; An extraction unit is used to extract key features from the target IPv6 address data, wherein the key features include related combination features, cross features, category features and time features, and process the original IPv6 address using a hash function to obtain the original features; The first operation unit is used to input the original features into the LG cross model for operation to obtain GRU_OUT, LSTM OUT , and input the key features into the LG cross model for calculation to obtain BatchNormal_OUT_1 and BatchNormal_OUT_2; The second operation unit is used to input GRU_OUT, LSTM_OUT, BatchNormal_OUT_1 and BatchNormal_OUT_2 into the fully connected layer for operation to obtain GRU_OUT′, LSTM_OUT′, BatchNormal_OUT_1′ and BatchNormal_OUT_2′; The fusion unit is used to fuse GRU_OUT′, LSTM_OUT′, BatchNormal_OUT_1′ and BatchNormal_OUT_2′ with weights of 0.3, 0.3, 0.2 and 0.2 respectively, and finally output the result; A prediction unit is used to predict the active address according to the final output result.

7. The device for predicting active IPv6 addresses based on big data according to claim 6, characterized in that: The IPv6 address set includes addresses in the open source address set for consecutive days; In the aspect of performing data cleaning on the IPv6 address data to obtain the target IPv6 address data, the acquisition unit is specifically used for: Sorting the target IPv6 address data in the order of acquisition time to obtain a first data sequence; Target IPv6 address data is extracted from the first data sequence, where the target IPv6 address is data in the IPv6 address data excluding missing values ​​and abnormal values.

8. The device for predicting active IPv6 addresses based on big data according to claim 7, characterized in that: In the aspect of using a hash function to process the original IPv6 address to obtain the original feature, the extraction unit is specifically used for: The original IPv6 address is processed using the method shown in the following formula to obtain the original features: MappedValue=PEP(InputData)mod Range, Among them, PEP is a hash function that maps the input data to a 512-bit hash value, mod means modulus, and the value of Range is 13331.

9. A terminal, characterized in that: The method comprises a processor, an input device, an output device and a memory, wherein the processor, the input device, the output device and the memory are interconnected, wherein the memory is used to store a computer program, the computer program comprises program instructions, and the processor is configured to call the program instructions to execute the method according to any one of claims 1 to 5.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and when the program instructions are executed by a processor, the processor is caused to perform the method according to any one of claims 1 to 5.

Images