IPv6 address detection method based on set division and spatial prediction

Abstract

The invention discloses an IPv6 (Internet Protocol Version 6) address detection method based on set division and spatial prediction. The method comprises the following steps of: 1, acquiring an initial seed IPv6 address set; 2, dividing information of multiple dimensions of the IPv6 seed address set by adopting a set division algorithm to form a tree structure from a node to a leaf node; 3, dividing an address space in which a survival address possibly exists for each leaf node by adopting a space prediction algorithm; the IPv6 address set generated after processing of the set division algorithm and the space prediction algorithm not only has a high survival address hit rate, but also improves the detection efficiency, and provides powerful support for safety monitoring and management of an IPv6 network.

Description

Technical Field

[0001] The invention relates to the field of IPv6 address generation and detection, and in particular to an IPv6 address detection method based on set partitioning and space prediction. Background Art

[0002] With the rapid development of information technology, cyberspace security has become a topic of great concern. Especially in today's digital and networked world, cybersecurity is directly related to national security, social stability and personal privacy. However, with the gradual exhaustion of IPv4 address resources, the widespread application of IPv6 has become an inevitable choice. With its huge address space, IPv6 provides a broader space for the development of the Internet, but it also brings new challenges to cyberspace security.

[0003] The capacity of IPv6 address space is much larger than that of IPv4 address space. Traditional network scanning and live address detection technologies are mostly designed based on IPv4, and they rely on the continuity and finiteness of address space. In IPv4 environment, it is relatively easy to find live hosts by scanning address segments one by one. However, in IPv6 environment, this method becomes inefficient and unfeasible. The huge and decentralized IPv6 address space has caused the number of addresses that need to be scanned by traditional scanning methods to increase dramatically, which is not only time-consuming and labor-intensive, but also unsatisfactory.

[0004] In addition, some features and mechanisms of IPv6 also bring new risks to cyberspace security. For example, although the Neighbor Discovery Protocol (NDP) of IPv6 facilitates automatic configuration and communication between devices, it can also be used by attackers to carry out network attacks. Attackers can forge NDP messages to deceive target devices and carry out various attacks.

[0005] Therefore, how to efficiently and accurately detect live IPv6 addresses has become an urgent problem to be solved in the field of cyberspace security. Summary of the invention

[0006] In view of this, the present invention provides an IPv6 address detection method based on set partitioning and space prediction to improve the security monitoring and management of IPv6 networks.

[0007] The technical solution of the present invention to solve the above technical problems is as follows:

[0008] The IPv6 address detection method based on set partitioning and space prediction includes:

[0009] Step 1: Obtain an initial set of seed IPv6 addresses and mine multiple dimensions of information from a larger set of IPv6 seed addresses, where the multiple dimensions of information include ASN number, BGP prefix, 40 port open rates, and IID feature values;

[0010] Step 2: Use a set partitioning algorithm to partition the information of multiple dimensions of the IPv6 seed address set, cluster the IPv6 addresses with the greatest correlation, and form a tree structure from nodes to leaf nodes;

[0011] Step 3: Use a space prediction algorithm to divide the address space where the surviving addresses may exist for each leaf node;

[0012] Step 4: Determine the most suitable parameter set V according to the mean value of the address space size; V contains the range standard value r, the Gini standard value g, and the value type standard value t;

[0013] According to the standard value in the parameter set V, a suitable distribution representation strategy is selected for each nibble bit, and the distribution strategy representation of each nibble bit is selected according to the rule;

[0014] Step 5: According to the distribution strategy representation of the leaf node, traverse the address space represented by the set to predict and obtain the surviving addresses;

[0015] Step 6: Repeat steps 3 to 5 to perform operations on all leaf nodes to obtain all predicted survival addresses.

[0016] Specifically, in step 1, a batch of active IPv6 seed addresses are obtained through DNS resolution, passive traffic extraction, and third-party data collection to form an initial seed IPv6 address set.

[0017] Specifically, in the tree structure described in step 2, the root node of the tree is the initial seed address set input by the algorithm, and the leaf nodes of each layer are the new address sets obtained after the current layer division is completed; there is no intersection between the leaf nodes, and their union is the root node;

[0018] The method of using a set partitioning algorithm to partition the IPv6 seed address set includes:

[0019] Layer 1 and 2: First, the input IPv6 address set is divided according to the ASN number and BGP prefix;

[0020] The third layer: Count the open rates of 40 ports of the leaf node IPv6 addresses and divide the leaf nodes obtained in the first two layers;

[0021] The fourth layer: The IID eigenvalue is a numerical variable, which is obtained by quantizing the interface identifier of the IPv6 address through the position-frequency function;

[0022] Then, according to the eigenvalue transition position, the leaf nodes obtained from the previous level are further divided; among them, the IID eigenvalue calculation formula Y(x) is as follows:

[0023]

[0024] W(c i )=F(c i ) (len(x)-P(c i )+1) (2)

[0025] Where x is the IID of each IPv6 address, len(x) is the length of x, and c i is the character of each digit in x, i∈[1,I], I=len(x), c i The value range is hexadecimal [0, F]; W(c) is the position-frequency function value of the current character, P(c) is the position function calculated for each character c in x, and F(c) is the frequency function calculated for character c in x; the calculation formulas of P(c) and F(c) are as follows:

[0026]

[0027] Where Nc is the number of times character c appears in x, Lc is the sum of all positions where character c appears in x, and K is the number of occurrences of each character c.

[0028] Specifically, step 3 uses a space prediction algorithm to divide the address space where the surviving addresses may exist for each leaf node, including:

[0029] 1) Count three key calculation quantities to determine the distribution representation strategy adopted for each half-byte bit; the three key calculation quantities are:

[0030] Range: Count the difference between the minimum and maximum values ​​of the nibble bit;

[0031] Number of value types: count the number of different values ​​of the nibble bit;

[0032] Gini impurity: It counts the uneven distribution of each character in the half-byte position. The calculation formula is:

[0033]

[0034] Where T is the set of all characters that appear in the current half-byte position, t∈T; p(x i=t) is the number of times the i-th nibble character t occurs in the current address set divided by the total number of addresses in the address set.

[0035] 2) Three distribution representation strategies are used to predict each nibble bit of the IPv6 address, including:

[0036] Single: Indicates that the address set has only one fixed value in this half-byte position;

[0037] List: represents the set of all values ​​of the address set in this half-byte position;

[0038] UpperRange: represents the closed interval between the minimum value of the address set at the half-byte position and the hexadecimal maximum value F;

[0039] 3): Calculate the address space: The address space size calculation formula for each strategy is as follows:

[0040]

[0041] Among them, L i is the number of values ​​of the i-th List strategy; U jmin is the minimum value among all the values ​​of the j-th UpperRange strategy; S is the current address space size; after the calculation is completed, the average size of each address space is determined:

[0042]

[0043] Where K is the number of all address spaces calculated, k∈K; the standard values ​​are determined according to the mean value of the address space:

[0044]

[0045] The present invention provides an IPv6 address detection method based on set partitioning and space prediction. The method deeply mines the multi-dimensional information associations between IPv6 addresses, utilizes multi-dimensional information such as address allocation rules and network topology structures, performs cluster analysis on the IPv6 address space, and realizes detailed partitioning and precise positioning of the IPv6 address space.

[0046] The IPv6 address set generated after processing by the set partitioning algorithm and the space prediction algorithm not only has a higher surviving address hit rate, but also improves the detection efficiency, providing strong support for the security monitoring and management of the IPv6 network. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 The hierarchical structure of the set partitioning algorithm obtained in the present invention; DETAILED DESCRIPTION

[0048] The principles and features of the present invention are described below in conjunction with the accompanying drawings. The examples given are only used to explain the present invention and are not used to limit the scope of the present invention.

[0049] Existing IPv6 address generation algorithms have problems such as being unable to deeply mine and utilize address hidden information, and the address modeling space is too broad. For example, the pattern-based binary search tree method relies on the bit values ​​of the address set to represent the address range, so the address space range obtained is too small; for the 6Gen and 6Tree algorithms, the address range obtained is too large, resulting in low address detection efficiency and hit rate. Therefore, developing an address space modeling method that is both accurate and efficient is crucial to improving the accuracy and efficiency of IPv6 live address detection.

[0050] In order to efficiently and accurately detect IPv6 live addresses, the present invention proposes a new scanning and detection method suitable for IPv6 environment.

[0051] The IPv6 address detection method based on set partitioning and space prediction includes:

[0052] S1: Collect seed address sets. Obtain a batch of active IPv6 seed addresses through DNS resolution, passive traffic extraction, third-party data collection, etc. to form an initial seed address set.

[0053] S2: For a larger set of IPv6 seed addresses, mine information in multiple dimensions to quantify the hidden associations between addresses. This should include ASN numbers, BGP prefixes, open rates of 40 major ports, and IID feature values.

[0054] The IID eigenvalue is a numerical variable, which is obtained by quantifying the interface identifier of the IPv6 address through the position-frequency function. Then, the leaf nodes obtained from the previous level are further divided according to the eigenvalue transition position. The IID eigenvalue calculation formula Y(x) is as follows:

[0055]

[0056] W(c i )=F(c i ) (len(x)-P(c i )+1) (2)

[0057] Where x is the IID of each IPv6 address, len(x) is the length of x, and c i is the character of each digit in x, i∈[1,I], I=len(x), c iThe value range is hexadecimal [0, F]. W(c) is the position-frequency function value of the current character, P(c) is the position function calculated for each character c in x, and F(c) is the frequency function calculated for character c in x. The calculation formulas for P(c) and F(c) are as follows:

[0058]

[0059] Where Nc is the number of times character c appears in x, Lc is the sum of all positions where character c appears in x, and K is the number of occurrences of each character c.

[0060] The IID eigenvalue calculation method considers the common position and frequency of each half-byte character in the IID of the IPv6 address, and counts and quantifies its position and frequency. The final Y(x) is a value that is highly dependent on the character appearance pattern and position distribution in the interface identifier. This allows the IPv6 address to be divided at the IID level.

[0061] S3: Using the set partitioning algorithm, the set is partitioned according to the deep and multi-dimensional information obtained in S2, and the IPv6 addresses with the greatest correlation are clustered. Finally, a tree structure from node to leaf node is formed, see Figure 1 .

[0062] The root node of the tree is the initial seed address set input by the algorithm, and the leaf nodes of each layer are the new address sets obtained after the current layer partitioning is completed. There is no intersection between these leaf nodes, and their union is the root node. The following shows the pseudo code of the set partitioning algorithm, and its core idea is as follows:

[0063] Layer 1 and 2: First, the input original IPv6 address set is divided according to the ASN number and BGP prefix respectively;

[0064] The third layer: divide the leaf nodes obtained in the first two layers according to the open rates of the 40 main ports of the IPv6 address;

[0065] Fourth layer: Divide the leaf nodes obtained in the third layer according to the IID eigenvalues ​​calculated in S2. The pseudo code of the algorithm is as follows:

[0066]

[0067]

[0068] S4: Obtain each leaf node obtained after the division in S3 and use the space prediction algorithm to accurately divide the address space where the live addresses may exist. In this step, first take a leaf node and determine the distribution representation strategy adopted by each half-byte bit of the address set in the node. Three key statistics need to be calculated:

[0069] Range: Count the difference between the minimum and maximum values ​​of the nibble bit;

[0070] Number of value types: count the number of different values ​​of the nibble bit;

[0071] Gini impurity: It counts the unevenness of the distribution of each character in the half-byte. The calculation formula is:

[0072]

[0073] Where T is the set of all characters that appear in the current half-byte position, t∈T. p(x i =t) is the number of times the i-th nibble character t occurs in the current address set divided by the total number of addresses in the address set.

[0074] S5: Calculate the address space. First, the algorithm uses three distribution representation strategies to predict each half-byte bit of the IPv6 address, including:

[0075] Single: Indicates that the address set has only one fixed value in this half-byte position;

[0076] List: represents the set of all values ​​of the address set in this half-byte position;

[0077] UpperRange: represents the closed interval between the minimum value of the address set at the half-byte position and the hexadecimal maximum value F;

[0078] Secondly, enumerate the address space of each current strategy. The address space size calculation formula is as follows:

[0079]

[0080] Among them, L i is the number of values ​​of the i-th List strategy. jmin is the smallest value among all the values ​​of the j-th UpperRange strategy. S is the current address space size. After the calculation is completed, the average size of each address space is determined:

[0081]

[0082] Where K is the number of all address spaces calculated, k∈K. The standard values ​​are determined based on the mean value of the address space:

[0083]

[0084] S6: According to the mean value of the address space size, determine the parameter set V that is most suitable for this set. V contains the range standard value r, the Gini standard value g, and the value type standard value t. According to the standard values ​​in the parameter set V, select the appropriate distribution representation strategy for each half-byte bit, and select the distribution strategy representation for each half-byte bit according to the rules. The selection rules are as shown in Table 1:

[0085] Table 1 Distribution strategy representation selection

[0086]

[0087] S7: According to the distribution representation strategy of the leaf node finally obtained, the address space represented by the set is traversed to predict and obtain the surviving addresses.

[0088] Step S8: Repeat S4 to S7, and perform operations on all leaf nodes to obtain all predicted survival addresses.

[0089] By identifying the regularity and pattern in address allocation, the present invention can separate potential active address areas, thereby significantly improving the efficiency and hit rate of address detection. By performing spatial prediction on the results of address clustering, a more accurate set of surviving addresses can be generated, thereby improving the hit rate and efficiency of detection. The spatial prediction algorithm can effectively cope with the hugeness and dispersion of the IPv6 address space, reduce the blindness and randomness in the detection process, and allow us to perform targeted detection within the predicted spatial range, avoiding blind scanning of the huge IPv6 address space, thereby significantly reducing the time and resources required for detection.

[0090] The method provided by the present invention is applied, and the more classic 6GEN, 6Tree and DET methods are used as baselines to verify the actual effect of the present invention. Among them, the main purpose of 6GEN is to identify dense address space areas from a set of known "seed" addresses, and finally generate a set of candidate addresses to be scanned; 6Tree and DET interleave the detection and generation of IPv6 addresses, and dynamically adjust the generation direction of addresses. In this experiment, various methods are used to generate 100,000, 200,000 and 300,000 possible surviving IPv6 addresses, and the hit rates of various algorithms are compared.

[0091]

[0092] According to the data in the above table, it can be found that the method used in the present invention has the highest hit rate, and can hit more than 100,000 active IPv6 addresses even when 300,000 IPv6 addresses are generated. Therefore, it can be considered that after the seed address set is divided into multiple layers and fine-grained, the IPv6 seed addresses with similar characteristics are effectively clustered, which is conducive to the understanding and generation of the address structure of each leaf node in the subsequent address generation.

[0093] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. An IPv6 address detection method based on set partitioning and space prediction, characterized in that: include: Step 1: Obtain an initial set of seed IPv6 addresses and mine multiple dimensions of information from a larger set of IPv6 seed addresses, where the multiple dimensions of information include ASN number, BGP prefix, 40 port open rates, and IID feature values; Step 2: Use a set partitioning algorithm to partition the information of multiple dimensions of the IPv6 seed address set, cluster the IPv6 addresses with the greatest correlation, and form a tree structure from nodes to leaf nodes; Step 3: Use a space prediction algorithm to divide the address space where the surviving addresses may exist for each leaf node; Step 4: Determine the most suitable parameter set V according to the mean value of the address space size; V contains the range standard value r, the Gini standard value g, and the value type standard value t; According to the standard value in the parameter set V, a suitable distribution representation strategy is selected for each nibble bit, and the distribution strategy representation of each nibble bit is selected according to the rule; Step 5: According to the distribution strategy representation of the leaf node, traverse the address space represented by the set to predict and obtain the surviving addresses; Step 6: Repeat steps 3 to 5 to perform operations on all leaf nodes to obtain all predicted survival addresses.

2. The IPv6 address detection method based on set partitioning and space prediction according to claim 1, characterized in that: In step 1, a batch of active IPv6 seed addresses are obtained through DNS resolution, passive traffic extraction, and third-party data collection to form an initial seed IPv6 address set.

3. The IPv6 address detection method based on set partitioning and space prediction according to claim 1, characterized in that: In the tree structure described in step 2, the root node of the tree is the initial seed address set input by the algorithm, and the leaf nodes of each layer are the new address sets obtained after the current layer division is completed; There is no intersection between the leaf nodes, and their union is the root node; The method of using a set partitioning algorithm to partition the IPv6 seed address set includes: Layer 1 and 2: First, the input IPv6 address set is divided according to the ASN number and BGP prefix; The third layer: Count the open rates of 40 ports of the leaf node IPv6 addresses and divide the leaf nodes obtained in the first two layers; The fourth layer: The IID eigenvalue is a numerical variable, which is obtained by quantizing the interface identifier of the IPv6 address through the position-frequency function; Then, according to the eigenvalue transition position, the leaf nodes obtained from the previous level are further divided; among them, the IID eigenvalue calculation formula Y(x) is as follows: W(c i )=F(c i ) (len(x)-P(c i )+1) (2) Where x is the IID of each IPv6 address, len(x) is the length of x, and c i is the character of each digit in x, i∈[1,I], I=len(x), c i The value range is hexadecimal [0, F]; W(c) is the position-frequency function value of the current character, P(c) is the position function calculated for each character c in x, and F(c) is the frequency function calculated for character c in x; the calculation formulas of P(c) and F(c) are as follows: Where Nc is the number of times character c appears in x, Lc is the sum of all positions where character c appears in x, and K is the number of occurrences of each character c.

4. The IPv6 address detection method based on set partitioning and space prediction according to claim 1, characterized in that: Step 3 uses a space prediction algorithm to divide the address space where the surviving addresses may exist for each leaf node, including: 1) Count three key calculation quantities to determine the distribution representation strategy adopted for each half-byte bit; the three key calculation quantities are: Range: Count the difference between the minimum and maximum values ​​of the nibble bit; Number of value types: count the number of different values ​​of the nibble bit; Gini impurity: It counts the uneven distribution of each character in the half-byte position. The calculation formula is: Where T is the set of all characters that appear in the current half-byte position, t∈T; p(x i =t) is the number of times the i-th nibble character t occurs in the current address set divided by the total number of addresses in the address set. 2) Three distribution representation strategies are used to predict each nibble bit of the IPv6 address, including: Single: Indicates that the address set has only one fixed value in this half-byte position; List: represents the set of all values ​​of the address set in this half-byte position; UpperRange: represents the closed interval between the minimum value of the address set at the half-byte position and the hexadecimal maximum value F; 3): Calculate the address space: The address space size calculation formula for each strategy is as follows: Among them, L i is the number of values ​​of the i-th List strategy; U jmin is the minimum value among all the values ​​of the j-th UpperRange strategy; S is the current address space size; after the calculation is completed, the average size of each address space is determined: Where K is the number of all address spaces calculated, k∈K; the standard values ​​are determined according to the mean value of the address space:

Images