Internet-wide ipv6 full response prefix probe method and device, and storage medium

Abstract

The present application relates to the technical field of Internet IPv6 network measurement, in particular to an IPv6 full-response prefix detection method, device and equipment in Internet range and computer storage medium. The present application mines and utilizes the knowledge (i.e. address mode) useful to the active prefix under the detection target prefix from the existing seed prefix, so as to improve the efficiency of target prefix detection, and then enriches the seed prefix library through detection of new prefix; the present application can perform active IPv6 full-response prefix detection on any routing prefix, and always maintains a high hit rate.

Description

Technical Field

[0001] This invention relates to the field of Internet IPv6 network measurement technology, and in particular to a method, apparatus, device, and computer storage medium for detecting the full response prefix of IPv6 within the Internet. Background Technology

[0002] With the depletion of IPv4 address resources, IPv6, as the core of the next-generation Internet, is experiencing rapid development and widespread deployment globally. As of October 2024, nearly 45% of Google users accessed services via IPv6, compared to less than 2% a decade ago. Therefore, IPv6-related network measurement across the global Internet is becoming increasingly important. In recent years, research on IPv6 network measurement has been continuously emerging, including areas such as IPv6 active address detection, port detection, and topology discovery.

[0003] However, a special type of prefix in IPv6 has had a significant impact on IPv6 network measurements: the full response prefix. A full response prefix is ​​defined as a prefix in which all addresses under it respond to probes (such as ICMPv6 Echo Requests). For example, a / 48 full response prefix can cover 2... 80 While there are numerous response addresses, each address cannot correspond to a unique responder. Therefore, ignoring full response prefixes in network measurement activities can lead to a "full response prefix trap," wasting significant resources and time, introducing unnecessary biases, and potentially distorting measurement conclusions. For example, in IPv6 active address probing, failing to detect full response prefixes in time can gradually deplete all probing resources, resulting in meager returns. In a dataset containing 24.5 million active IPv6 addresses released on May 4, 2024, we found 4.8 million addresses under full response prefixes, representing 20% ​​of the total. Based on the current 20%-50% hit rate of most active address probing methods, this means that nearly 9.6 million to 24 million probes missed truly active addresses, resulting in wasted probing resources. Worse still, when conducting other network measurement activities (such as port scanning) based on these addresses, the measurement results may not accurately reflect the actual network situation, leading to misleading results.

[0004] Currently, research on full response prefixes is limited. Some active address probing studies have detected the existence of full response prefixes and proposed methods similar to brute-force probing to verify these prefixes in detected active addresses. Sattler et al. also studied similar prefixes (high response prefixes) under IPv4 using brute-force probing. However, under IPv6, even using high-speed tools like ZMap and Masscan, brute-force probing of full response prefixes across the entire internet is impractical. This is because the IPv6 address space is twice that of IPv4. 96 times.

[0005] Therefore, how to provide a long-term, efficient active detection method for full response prefixes is a problem that needs to be solved. Summary of the Invention

[0006] Therefore, the technical problem to be solved by the present invention is to overcome the problem of low efficiency of full response prefix detection in the prior art.

[0007] To address the aforementioned technical problems, this invention provides an IPv6 full response prefix detection method, comprising:

[0008] Obtain internet routing prefix data and known full response prefix data, and perform preprocessing;

[0009] Based on the known full response prefix data, the largest dataset is determined as the seed set;

[0010] Based on the Internet routing prefix data, address space probing technology is used to determine the full-response routing prefix and the non-full-response routing prefix, and the non-full-response routing prefix is ​​determined as the target prefix;

[0011] Based on the seed set, a search tree is independently constructed for each target prefix;

[0012] Based on the search tree for each target prefix, the full response prefix of the Internet is probed.

[0013] Preferably, constructing a search tree independently for each target prefix based on the seed set includes:

[0014] Based on the seed set, the target prefix is ​​divided into seeded prefixes containing seeds and seedless prefixes not containing seeds;

[0015] For any seed prefix, create it as the root node, and recursively perform expansion and backtracking based on the service ID of the root node to construct a search tree with the seed prefix;

[0016] For any seedless prefix, perform attribute matching with all seeded prefixes, merge the search trees of the seeded prefixes that successfully match, and construct the search tree for the seedless prefix.

[0017] Preferably, recursively performing the extension based on the service ID of the root node includes:

[0018] Starting from the root node, a seed path consisting of seed nodes is generated according to the seed service ID order.

[0019] For each layer of seed nodes, expand all potential nodes and associate each potential node with its parent node in the layer above.

[0020] Preferably, recursively performing backtracking based on the service ID of the root node includes:

[0021] Since the seed prefix contains known full response prefix data, the known values ​​on the seed path are updated based on the seed;

[0022] For any potential node, set its value and potential access count based on its seed node at the same level and its distance from the seed node.

[0023] Each node's prefix is ​​marked to distinguish between full response prefixes, incomplete response prefixes, and unknown prefixes.

[0024] Preferably, the detection of Internet full response prefixes based on the search tree for each target prefix includes:

[0025] For any target prefix search tree, starting from the root node, the optimal value node is recursively selected layer by layer to generate the optimal path. The optimal path cannot be completely consistent with the seed path, that is, the node in the last layer of the optimal path is a potential node.

[0026] Expand the potential nodes selected in the last layer of the optimal path by n child nodes;

[0027] Expand n addresses based on the selected potential nodes and the n child nodes;

[0028] Perform an online scan on the n addresses to determine whether there is a response;

[0029] The response status of n addresses is detected using the alias prefix detection method, and the value information of all nodes is updated by backpropagation.

[0030] Preferably, the step of performing attribute matching between any seedless prefix and all seeded prefixes, merging the search trees of the successfully matched seeded prefixes, and constructing the search tree for the seedless prefix includes:

[0031] For any seedless prefix, obtain its subordinate AS and match it with all subordinate ASs with seed prefixes.

[0032] If a match is successful, all matched search trees with seed prefixes that do not contain a root node are merged, and the value information of nodes from different search trees is accumulated and combined until the root node is successfully set to the corresponding seedless prefix.

[0033] If a seed prefix cannot be matched based on the subordinate AS, then the matching will proceed layer by layer based on the organization or business category to which the seed prefix belongs.

[0034] Preferably, the search tree based on each target prefix, after probing the full response prefix of the Internet, further includes:

[0035] Generate a list of full response prefixes based on the detected full response prefixes;

[0036] The known full response prefix data is updated based on the full response prefix list in order to perform the next round of probing.

[0037] The present invention also provides an IPv6 full response prefix detection device, comprising:

[0038] The data acquisition module is used to acquire Internet routing prefix data and known full response prefix data, and to perform preprocessing.

[0039] The seed set acquisition module is used to determine the largest dataset as the seed set based on the known full response prefix data;

[0040] The target prefix determination module is used to determine the full-response routing prefix and the non-full-response routing prefix based on the Internet routing prefix data and using address space probing technology, and to determine the non-full-response routing prefix as the target prefix;

[0041] The search tree construction module is used to independently construct a search tree for each target prefix based on the seed set;

[0042] The detection module is used to detect all response prefixes on the Internet based on a search tree for each target prefix.

[0043] The present invention also provides an IPv6 full response prefix detection device, comprising:

[0044] Memory, used to store computer programs;

[0045] A processor is used to implement the steps of the above-described IPv6 full response prefix detection method when executing the computer program.

[0046] The present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the above-described IPv6 full response prefix detection method.

[0047] The technical solution of the present invention has the following advantages over the prior art:

[0048] The IPv6 full response prefix detection method described in this invention first preprocesses Internet routing prefix data and known full response prefix data obtained from public channels. For known full response prefixes, the largest dataset is selected as the seed set. For Internet routing prefixes, address space probing technology is used to distinguish between full response routing prefixes (FRRP) and non-full response routing prefixes (NFRRP, i.e., target prefixes). After the search tree construction module obtains all target prefixes and seed data, it independently constructs search trees for each prefix. Subsequently, the full response prefix detection module uses the search trees of all target prefixes as input to continuously explore new full response prefixes. Finally, all detected full response prefixes are output, forming a full response prefix list. Furthermore, this list can be used to update known full response prefix data for the next round of detection. This invention mines and utilizes knowledge (i.e., address patterns) useful for detecting active prefixes under the target prefix from existing seed prefixes to improve the efficiency of target prefix detection, and then enriches the seed prefix library by detecting new prefixes. This invention can actively detect IPv6 full response prefixes for any routing prefix and consistently maintain a high hit rate. Attached Figure Description

[0049] To make the content of this invention easier to understand, the invention will be further described in detail below with reference to specific embodiments and accompanying drawings, wherein:

[0050] Figure 1 This is a flowchart illustrating the implementation of an IPv6 full response prefix detection method provided by the present invention;

[0051] Figure 2 This is a flowchart of the implementation of Luori, an IPv6 full response prefix detection method based on reinforcement learning;

[0052] Figure 3 This is a diagram illustrating the construction of the search tree;

[0053] Figure 4 This is a schematic diagram of the IPv6 full response prefix detection process. Detailed Implementation

[0054] The core of this invention is to provide an IPv6 full response prefix detection method, apparatus, device, and computer storage medium, which effectively improves the efficiency of IPv6 full response prefix detection.

[0055] To enable those skilled in the art to better understand the present invention, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0056] Please refer to Figure 1 , Figure 1 The flowchart illustrates the implementation of the IPv6 full response prefix detection method provided by this invention; the specific operation steps are as follows:

[0057] S101: Obtain Internet routing prefix data and known full response prefix data, and perform preprocessing;

[0058] S102: Based on the known full response prefix data, determine the largest dataset as the seed set;

[0059] S103: Based on the Internet routing prefix data, using address space probing technology, determine the full-response routing prefix and the non-full-response routing prefix, and determine the non-full-response routing prefix as the target prefix;

[0060] S104: Based on the seed set, independently construct a search tree for each target prefix;

[0061] S105: Probe the full response prefix of the Internet based on the search tree of each target prefix.

[0062] This invention aims to propose an efficient proactive detection method for full response prefixes across the entire network, and to conduct long-term detection to construct and maintain a long-term full response prefix list. On one hand, the full response prefix list can help researchers mitigate the impact of full response prefixes on their measurement activities and serve as a dataset to reduce unnecessary network burden caused by redundant measurements. On the other hand, it can also reveal the status and characteristics of a large number of full response prefixes across the entire network, helping to explore their use cases and implementation methods, and providing in-depth insights into their practical applications. Therefore, this invention proposes a reinforcement learning-based IPv6 full response prefix detection method, Luori, which can proactively detect IPv6 full response prefixes for any routing prefix and consistently maintain a high hit rate. Its core idea is to mine and utilize knowledge (i.e., address patterns) useful for active prefixes under the target prefix from existing seed prefixes to improve the efficiency of target prefix detection, and then enrich the seed prefix library by detecting new prefixes.

[0063] like Figure 2 As shown, in this method, we independently create a search tree for each target prefix, which not only reflects the entire probe space under that target prefix, but also reveals the possibility of full response prefix patterns. Then, using the search tree of each target prefix, we continuously generate candidate full response prefixes and determine whether they are true full response prefixes through active probing.

[0064] When conducting global full response prefix (FRRP) probing, we first preprocess the Internet routing prefix data and known FRRP data obtained from public channels. For known FRRPs, we select the largest dataset as the seed set. For Internet routing prefixes, we utilize address space probing technology to generate 16 sub-prefixes in hexadecimal format after the routing prefix, and generate a random probe for each sub-prefix, for a total of 16 probes. We then send ICMPv6 packets to detect their activity. If all 16 probes are active, it is identified as a FRRP, thus distinguishing it from non-FRRPs (i.e., target prefixes). After the search tree construction module obtains all target prefixes and seed data, it constructs search trees independently for each prefix. Subsequently, the FRRP probing module uses the search trees of all target prefixes as input to continuously explore new FRRPs. Finally, Luori outputs all detected FRRPs, forming a list of FRRPs. Furthermore, this list can be used to update the known FRRP data for the next round of probing.

[0065] Based on the above embodiments, this embodiment will provide a detailed description of step S104:

[0066] S401: Based on the seed set, the target prefix is ​​divided into seeded prefixes containing seeds and seedless prefixes not containing seeds;

[0067] S402: For any seed prefix, create it as the root node, and recursively perform expansion and backtracking based on the service ID of the root node to construct a search tree with the seed prefix;

[0068] For a target prefix containing a seed (i.e., a seed prefix), we can directly construct a search tree. For example... Figure 3 As shown, when building a search tree based on seeds with seed prefixes, we first create a root node (i.e., a seeded routing prefix), and then recursively perform expansion and backpropagation based on the SID (Service ID) of each seed to build a complete search tree. Different levels of the search tree represent prefixes of different lengths, and each node can represent a prefix (i.e., the path to that node). Furthermore, the state of each node is reflected by its value (e.g., whether it is a full-response prefix). All nodes and their states represent the full-response prefix pattern of the target prefix, and the full-response prefix pattern changes dynamically as the node state changes.

[0069] S403: For any seedless prefix, perform attribute matching with all seeded prefixes, merge the search trees of the successfully matched seeded prefixes, and construct the search tree for the seedless prefix.

[0070] Since the seeds are finite, most target prefixes are seedless (i.e., seedless prefixes). For such prefixes, we propose a cross-prefix search tree transition strategy to construct the search tree.

[0071] Based on the above embodiments, this embodiment will provide a detailed description of step S402:

[0072] We expand directly from the root node based on the SID of each seed. The depth of the expansion is determined by the length of the SID. Specifically, the expansion consists of two parts: seed node expansion and potential node expansion.

[0073] S4021: Starting from the root node, generate a seed path consisting of seed nodes according to the seed service ID order;

[0074] Seed node expansion refers to expanding directly from top to bottom in the tree, following the left-to-right order of the seed SIDs. This process forms a seed path in the tree, composed of seed nodes, representing a known successful search path (i.e., a full-response prefix). The core of seed-guided expansion lies in the fact that the seed pattern can initially represent the overall pattern of the target prefix; that is, the probability of a potential full-response prefix s existing within a seed region (immediately adjacent to the seed node) is higher because they share a consistent pattern.

[0075] S4022: Expand all potential nodes for the seed node of each layer and associate the potential nodes with the parent node of the layer above.

[0076] We also perform potential node expansion on a single seed node along the seed path. Specifically, we first expand all potential nodes (i.e., 0-f) at the same level as the seed node, and then associate them with their parent nodes at the upper level.

[0077] like Figure 3 As shown in a specific example:

[0078] When there is a seed prefix of 2001:5af3:: / 32 (i.e., the root node), x = 32. If one of its seeds is 2001:5af3:1f90:: / 44, and assuming it is the first seed in the recursive process, its SID is "1f9". The expanded seed nodes are "1", "f", and "9", forming a seed path. Other expanded nodes are potential nodes. The expansion depth reaches level 4. Each node in the tree represents a prefix. For example, the potential node "2" in level 2 represents the prefix 2001:5af3:2000:: / 36, and the leaf seed node "9" in level 4 represents the seed 2001:5af3:1f90:: / 44. However, it should be noted that non-leaf seed nodes do not represent seeds, as they are only the parent prefix of the seed. For example, the seed node "f" in level 3 represents the parent prefix 2001:5af3:1f00:: / 40.

[0079] The goal of backpropagation is to update the state (i.e., V information) of each node layer in reverse order, starting from the leaf seed node and continuing until the root node is reached. This phase mainly consists of two parts: backpropagation of known values ​​and backpropagation of potential values.

[0080] S4023: Since the seed prefix contains known full response prefix data, update the known values ​​on the seed path according to the seed;

[0081] In known value backtracking, since the seed is a known full response prefix (full response prefix), the known values ​​(Vk) of all seed nodes on the seed path will be updated.

[0082] S4024: For any potential node, set its corresponding value and potential access count based on its seed node at the same level and its distance from the seed node.

[0083] In the backpropagation of potential value, potential nodes receive value (Vp) from neighboring seed nodes. The Vp received by different potential nodes from a seed node gradually decreases from near to far (i.e., Vp = v--), because the closer to the seed pattern, the more likely it is to be a full response prefix (full response prefix). At the same time, the potential number of visits (Np) to the potential node also increases by 1 (i.e., Np+=1).

[0084] However, their Vp and Np values ​​do not propagate upwards because they have not actually been visited and have no known value. They simply have a higher probability of becoming full-response prefix nodes, and their true value needs further exploration.

[0085] S4025: Distinguish between full response prefixes, incomplete response prefixes, and unknown prefixes for the prefixes represented by each node.

[0086] We also indicate whether the prefix represented by the node is a full response prefix. A flag value (Vf) of 0 indicates a non-full response prefix (N full response prefixes), Vf = 1 indicates a full response prefix (e.g., a seed), and Vf = 2 indicates unknown.

[0087] like Figure 3 In a specific example:

[0088] The current state of the search tree after expansion and backpropagation based on the first seed 2001:5af3:1f90:: / 44 at v=16. The root node (i.e., the seed prefix) is pre-determined to be a non-full response route prefix (NFRRP), so Vf=0. The seed node "9" (i.e., the seed) in level 4 has Vf=1, and all other nodes have Vf=2. Note that the seed nodes "1" and "f" also have Vf=2, because the parent prefix of the seed may also be a full response prefix.

[0089] Based on the above embodiments, this embodiment will provide a detailed description of step S403:

[0090] As the above process is recursively executed, the state of this node will undergo continuous changes. The node's Vk, Nk, Vp, and Np will accumulate, and Vf may also change. For example, when a new seed is loaded, the potential node's Vf may change from 2 to 1. When all seeds are loaded into a search tree under a seed prefix, this search tree represents the current full-response prefix (full-response prefix) pattern of the seed prefix and its entire potential probe space (because the tree can be continuously expanded), and then the subsequent full-response prefix probe process is initiated. However, for seedless prefixes, since they have no prior knowledge (i.e., seeds), the full-response prefix pattern is completely unknown. Therefore, we also propose an inter-prefix search tree transfer strategy, the goal of which is to transfer some potentially similar search trees (i.e., full-response prefix patterns) from the seed prefix to each seedless prefix. Otherwise, it is difficult to initiate probes.

[0091] The core of this strategy is that target prefixes with the same attributes (e.g., AS) have similar full-response prefix patterns; that is, the relevant attributes of the target prefixes are used to transfer the search tree. First, based on network management experience, prefixes with similar attributes may have consistent configurations because they typically have consistent use cases and are managed by the same network engineers. This experience also applies to similar tasks, such as proactive address probing. Furthermore, we tested the strategy based on three attributes: the selected subordinate AS, organization, and business category. We found that the seed entropy under a single attribute is lower than the entropy of all seeds, especially for AS. Therefore, based on these three attributes, we designed a hierarchical transfer strategy from fine-grained to coarse-grained.

[0092] S4031: For any seedless prefix, obtain its subordinate AS and match it with all subordinate ASs with seed prefixes.

[0093] S4032: If a match is successful, merge all the matched search trees with seed prefixes that do not contain a root node, and accumulate and combine the value information of nodes from different search trees until the root node is successfully set to the corresponding seedless prefix.

[0094] For a seedless prefix, we first obtain its search tree (AS), and then match it against the ASs of all seed prefixes. If a match is successful, the search trees of all matching seed prefixes (excluding the root node) are merged to create a new tree. During the merging process, nodes from different trees are combined, and the value information of the nodes is accumulated. Once the root node is set to a seedless prefix, the search tree transition is complete.

[0095] S4033: If a seed prefix cannot be matched based on the subordinate AS, then match layer by layer based on the organization or business category to which the seed prefix belongs.

[0096] If any search tree cannot be matched based on AS, then matching will proceed layer by layer according to the organization or business category to which the prefix belongs. Because the granularity of business categories is very coarse, eventually all target prefixes will result in a single search tree.

[0097] Based on the above embodiments, this embodiment will provide a detailed description of step S105:

[0098] Because the search tree can continuously expand, its search space is enormous. At the same time, seed patterns may not fully represent all response prefix patterns under the target prefix; for example, they may be incomplete. Therefore, relying solely on seed patterns for probing may result in a large number of full response prefixes being missed. To address this issue, we need to balance the depth and breadth of the search to ensure comprehensive coverage of the potential full response prefix space.

[0099] Since the number of full response prefixes has not been discovered, to address this challenge, we propose a clever ∈-Q strategy based on reinforcement learning. This strategy allocates limited probe resources to more valuable branches to discover more new full response prefixes. Furthermore, the tree is continuously updated based on probe feedback (i.e., patterns) so that ∈-Q can make optimal decisions in real time. Figure 4 The workflow of dynamic detection is demonstrated, which iteratively executes the selection, detection, and backpropagation modules based on the budget (B) for each target prefix.

[0100] S1051: For any target prefix search tree, starting from the root node, recursively select the optimal value node layer by layer to generate the optimal path. The optimal path cannot be completely consistent with the seed path, that is, the node in the last layer of the optimal path is a potential node.

[0101] First, we need to select the most valuable branch in the current search tree state (i.e., generate a candidate full response prefix). The recursive selection process starting from the root node is typically accomplished using a strategy that leverages the value information of nodes in the current tree state to make the optimal choice. However, this optimal choice is not always to select a known better node (e.g., seed nodes "1" and "f"). While we select along the seed path as much as possible (i.e., utilizing existing seed prior knowledge), it also needs to be able to select other unknown paths (i.e., exploring the seed-free space) to avoid getting stuck in the seed pattern without any chance of discovering other full response prefix patterns. To achieve a balance between utilization and exploration, this invention designs a selection strategy ∈-Q based on the ∈-Greedy algorithm.

[0102] S1052: Expand the potential nodes selected in the last layer of the optimal path by n child nodes;

[0103] For the selected node, we first expand its child nodes, that is, create a total of 16 child nodes from 0 to f.

[0104] S1053: Expand n addresses based on the selected potential nodes and the n child nodes;

[0105] These 16 addresses are randomly expanded based on the selected node and the expanded child nodes.

[0106] S1054: Perform an online scan of the n addresses to determine whether a response is needed;

[0107] These 16 addresses are scanned online by sending ICMPv6 requests to determine if they respond, as these addresses reflect the state of the selected node and the possible states of its child nodes.

[0108] like Figure 4 As shown in a specific example:

[0109] Based on the selected "1f8", the 16 addresses obtained through expansion are 2003:89af:0011:1f8{0-f}:****:****:****:****.

[0110] It's possible that only address 2003:89af:0011:1f8{0-1}:****:****:****:**** is responding.

[0111] S1055: Probe the response status of n addresses using the alias prefix detection method and backpropagate to update the value information of all nodes.

[0112] The Alias ​​Prefix Detection (APD) method probes the response status of 16 addresses and updates the node's value information (i.e., the tree's state), starting from the 16 expanded child nodes and proceeding backwards layer by layer until the root node is reached. It's important to note that once a potential node is selected and probed, it becomes a known node. Before performing backpropagation, its value information is converted from Vp and Np to Vk and Nk, and initialized to 0.

[0113] Specifically, the following three situations will occur:

[0114] Case 1: When all 16 addresses have responses, the selected node is a full response prefix. In this case, consistent with backpropagation in search tree construction, the Vk and Nk of all nodes on the selected path will be incremented by v and 1, respectively. The corresponding Vp (i.e., v--) will be propagated to potential nodes. Furthermore, the Vf of the selected node is set to 1, and any expanded child nodes will be pruned.

[0115] Case 2: When 16 addresses partially respond (e.g., only m addresses respond), Vk and Nk of all nodes on the selected path will be incremented by m and 1, respectively. The Vp and Np of responding child nodes will be incremented by 1, while the Vp of non-responding child nodes will be 0, but Np will be incremented by 1.

[0116] Case 3: When all 16 addresses are unresponsive, the selected node's Vk is 0 and backpropagation is not performed, but the Nk of all nodes on the selected path is incremented by 1. Similarly, the Vp of all child nodes is 0, but Np is incremented by 1. Furthermore, for cases 2 and 3, the selected node's Vf is set to 0, and the Vf of all its extended child nodes is set to 2. After updating the value information in reverse, the probe feedback is propagated throughout the prefix space to optimize the next probe.

[0117] like Figure 4 As shown in a specific example:

[0118] Based on the probe results, the Vk of the selected node "8" is updated to 2 and propagated back to the root node, whose Vf is updated to 0. The Vp and Np of the extended child nodes "0" and "1" are updated to 1. The Vp of the other extended child nodes is 0. The Vf of all extended child nodes is 2.

[0119] S1056: Generate a list of full response prefixes based on the detected full response prefixes;

[0120] S1057: Update the known full response prefix data according to the full response prefix list in order to perform the next round of probing.

[0121] This invention proposes an Internet-wide full response prefix detection method that can perform IPv6 full response prefix detection on any routing prefix.

[0122] To accurately handle full response prefixes of varying lengths and diverse patterns, this invention proposes utilizing the natural hierarchical properties of trees to represent the entire full response prefix detection space. To further accurately represent the patterns of full response prefixes, the tree structure is transformed into a search tree, where each node represents not only a prefix but also the current state.

[0123] This invention is based on the idea of ​​reinforcement learning, which transforms the active probing process under the huge prefix space of IPv6 into a dynamic search process in the tree based on reinforcement learning.

[0124] In order to be applicable to all routing prefixes within the Internet, this invention designs a search tree migration strategy based on prefix attributes for seedless routing prefixes.

[0125] This invention is the first active detection method for full response prefixes within a known Internet range. Based on a real seed dataset, Luori performs a single probe on all routing prefixes advertised by BGP and discovers 31.7K full response prefixes, covering 1.5 × 1.5 × 10^665 routes. 30 The address space is 1.3 * 10^645 bytes, which is currently the size of brute-force detection methods. 33 times.

[0126] To date, Luori has been continuously probing the internet for nearly six months, discovering 516K full response prefixes, covering 1.3 × 1.3 × 10^66 bytes. 33 Its address space and 795 ASs far exceed the existing full response prefix list, making it the largest known publicly available full response prefix list.

[0127] For a well-known and commonly used dataset of active IPv6 addresses, we found that 20% of the addresses belong to the full response prefixes we provided. Furthermore, our analysis revealed that the full response prefixes in the list primarily originate from approximately 650 organizations in industries such as cloud or CDN services and network security. Moreover, the implementation methods of full response prefixes are diverse; aside from specific technologies used by cloud or CDN vendors (such as Cloudflare's agile addressing method), most are implemented based on existing Linux system functionalities.

[0128] This invention advances research in network measurement, network mapping, and network security. IPv6 full response prefix detection establishes a full response prefix list, providing data support for network measurement, network mapping, and network security.

[0129] This invention supports the commercialization of IPv6 network products in the industrial network measurement and security fields. The detected full response prefix can effectively remove spoof addresses (addresses under the full response prefix) from active IPv6 addresses. The cleaned active IPv6 addresses better support the promotion of network measurement products in the next-generation Internet field, and further support security companies in expanding their IPv6 network products.

[0130] The detection of full response prefixes in this invention helps to understand the status of one's own IPv6 network, ensure national information network security, and seize the high ground and initiative in network security. The established full response prefix list is also an important foundation for network attacks such as service identification and location, vulnerability discovery, and penetration testing.

[0131] This invention provides an IPv6 full response prefix detection device; the specific device may include:

[0132] The data acquisition module is used to acquire Internet routing prefix data and known full response prefix data, and to perform preprocessing.

[0133] The seed set acquisition module is used to determine the largest dataset as the seed set based on the known full response prefix data;

[0134] The target prefix determination module is used to determine the full-response routing prefix and the non-full-response routing prefix based on the Internet routing prefix data and using address space probing technology, and to determine the non-full-response routing prefix as the target prefix;

[0135] The search tree construction module is used to independently construct a search tree for each target prefix based on the seed set;

[0136] The detection module is used to detect all response prefixes on the Internet based on a search tree for each target prefix.

[0137] The IPv6 full response prefix detection device in this embodiment is used to implement the aforementioned IPv6 full response prefix detection method. Therefore, the specific implementation of the IPv6 full response prefix detection device can be found in the previous embodiment section of the IPv6 full response prefix detection method. For example, the data acquisition module, seed set acquisition module, target prefix determination module, search tree construction module, and detection module are used to implement steps S101, S102, S103, S104, and S105 in the above-mentioned IPv6 full response prefix detection method. Therefore, its specific implementation can be referred to the description of the corresponding embodiments, which will not be repeated here.

[0138] A specific embodiment of the present invention also provides an IPv6 full response prefix detection device, comprising: a memory for storing a computer program; and a processor for executing the computer program to implement the steps of the above-described IPv6 full response prefix detection method.

[0139] A specific embodiment of the present invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the above-described IPv6 full response prefix detection method.

[0140] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0141] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0142] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0143] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0144] Obviously, the above embodiments are merely illustrative examples for clear explanation and are not intended to limit the implementation. Those skilled in the art will recognize that other variations or modifications can be made based on the above description. It is neither necessary nor possible to exhaustively list all possible implementations here. However, obvious variations or modifications derived therefrom are still within the scope of protection of this invention.

Claims

1. A method of IPv6 full-response prefix discovery, characterized by, The method comprises the following steps: Obtain Internet routing prefix data and known full response prefix data, and preprocess them; Based on the known full response prefix data, determine a maximum scale data set as a seed set; Based on the Internet routing prefix data, use address space exploration technology to determine full response routing prefixes and non-full response routing prefixes, and determine the non-full response routing prefixes as target prefixes; Based on the seed set, independently build a search tree for each target prefix, wherein, based on the seed set, divide the target prefixes into seed-containing prefixes and seed-free prefixes, for any seed-containing prefix, create it as a root node, and recursively perform expansion and backtracking according to the service ID of the root node to build a search tree of the seed-containing prefix, and for any seed-free prefix, perform attribute matching with all seed-containing prefixes, merge the search trees of the seed-containing prefixes that pass the matching, and build a search tree of the seed-free prefix; Based on the search tree of each target prefix, explore Internet full response prefixes. 2.The IPv6 full-response prefix probe method according to claim 1, wherein, The recursive expansion according to the service ID of the root node comprises the following steps: Take the root node as the starting point, and generate a seed path composed of seed nodes in the order of seed service IDs; Expand all potential nodes for each layer of seed nodes, and associate the potential nodes with the parent nodes of the previous layer. 3.The IPv6 full-response prefix probe method of claim 2, wherein, The recursive backtracking according to the service ID of the root node comprises the following steps: Since the seed contained in the seed-containing prefix is known full response prefix data, update the known values on the seed path according to the seed, wherein the known values on the seed path are initialized as 0; For any potential node, set its corresponding value according to the seed nodes in the same layer and the distance from the seed nodes, and set its corresponding potential access times; Mark the prefixes represented by each node with full response prefix, non-full response prefix and unknown. 4.The IPv6 full-response prefix probe method of claim 3, wherein, The exploration of Internet full response prefixes based on the search tree of each target prefix comprises the following steps: For the search tree of any target prefix, take the root node as the starting point, recursively select the optimal value node layer by layer, generate an optimal path, and the optimal path cannot be completely consistent with the seed path, that is, the node in the last layer of the optimal path is a potential node; Expand n child nodes for the potential node selected in the last layer of the optimal path; Expand n addresses based on the selected potential node and the n child nodes; Determine whether the n addresses respond or not through online scanning; Detect the response state of the n addresses according to the alias prefix detection method and update the value information of all nodes through back propagation, wherein, in the detection of the response state of the 16 addresses according to the alias prefix detection method, the value information of the nodes is updated, starting from the expanded 16 child nodes, and then back propagating layer by layer until reaching the root node.

5. The IPv6 all-responsive prefix probing method of claim 1, wherein, The matching of any seed-free prefix with all seed-containing prefixes, the merging of the search trees of the seed-containing prefixes that pass the matching, and the building of a search tree of the seed-free prefix comprise the following steps: For any seed-free prefix, obtain its subordinate AS, and match it with the subordinate AS of all seed-containing prefixes; If the matching is successful, all matched search trees without root node and with seed prefix are merged, and the value information of nodes from different search trees is accumulated and combined until the root node is successfully set to the corresponding non-seed prefix. If the matching with seed prefix cannot be matched according to the subordinate AS, the matching is performed layer by layer according to the organization or business category to which the non-seed prefix belongs. 6.The IPv6 full-response prefix probe method of claim 1, wherein, The search tree based on each target prefix further comprises the following steps of: generating a full response prefix list according to the detected full response prefix; updating the known full response prefix data according to the full response prefix list for the next round of detection.

7. An IPv6 full response prefix discovery apparatus, characterized by comprising: The method comprises the following steps of: a data acquisition module is configured to acquire Internet routing prefix data and known full response prefix data and perform preprocessing; a seed set acquisition module is configured to determine a maximum size data set as a seed set based on the known full response prefix data; a target prefix determination module is configured to determine full response routing prefixes and non-full response routing prefixes based on the Internet routing prefix data by using address space detection technology, and determine the non-full response routing prefixes as target prefixes; a search tree construction module is configured to independently construct a search tree for each target prefix based on the seed set, wherein the target prefixes are divided into seed-containing seed prefixes and seed-free non-seed prefixes based on the seed set, for any seed prefix, the seed prefix is created as a root node, and expansion and backtracking are recursively performed according to the service ID of the root node to construct a search tree of the seed prefix, and for any non-seed prefix, attribute matching is performed between the non-seed prefix and all seed prefixes, the search trees of the matched seed prefixes are merged, and a search tree of the non-seed prefix is constructed; a detection module is configured to detect Internet full response prefixes based on the search tree of each target prefix.

8. An IPv6 full response prefix probe device, characterized by, The method comprises the following steps of: a memory is configured to store a computer program; a processor is configured to implement the steps of the IPv6 full response prefix detection method according to any one of claims 1 to 6 when the computer program is executed.

9. A computer-readable storage medium, characterized in that, The computer program is stored on the computer readable storage medium, and the computer program is executed by the processor to implement the steps of the IPv6 full response prefix detection method according to any one of claims 1 to 6.

Images