Ipv6 address scanning method based on ant colony splitting hierarchical clustering

Abstract

An ipv6 address scanning method based on ant colony splitting hierarchical clustering comprises the following steps: aiming at large-scale ipv6 address survivability detection and an ant colony algorithm for searching an optimal path, generating a space tree and an address space by using an DHC algorithm, and initializing parameters and a formula of the ant colony algorithm according to address space information; in the first round of scanning, a preferential scanning area is selected according to the address space number, and after an existing area is scanned, a new address space is formed through aggregation; if the number of possible addresses in the newly formed address space is too large, according to the number of active addresses and the address space obtained by the first round of scanning, selecting the address space which is preferentially scanned in the second round, and then continuing to aggregate upwards to form a new address space; according to a pheromone formula, selecting an area which is preferentially scanned for the third time; and repeating the steps until the budget is used up, and ending scanning. According to the method, the technical problem of poor scanning effect caused by huge data volume in the prior art can be solved, and efficient and accurate scanning performance can be kept.

Description

Technical Field

[0001] The invention creates an ant colony algorithm for large-scale IPv6 address survival detection and optimal path search, and proposes an IPv6 address scanning method based on split hierarchical clustering of the ant colony algorithm. Background Art

[0002] Since IPv6 has a huge address space, it is difficult to scan the entire address space in a short time to obtain surviving addresses like IPv4, and the distribution of surviving addresses of IPv6 is extremely uneven, so the hit rate of conventional scanning methods for IPv6 address space is very low. For the above problems, existing technical methods are divided into two categories: based on semantic information and based on structural information. In the method based on semantic information, the seed is first converted into a vector according to the IPv6 vector space mapping technology (i.e., IPv62Vec). After IPv62Vec, the vector dataset will be used to train deep neural networks (such as transformers, variational autoencoders, and generative adversarial networks), and then the IPv6 target generation problem is converted into a solved text generation problem. However, the huge computational cost of deep neural networks means that these methods cannot be extended to large-scale scanning. In the method based on structural information, the structural information of the seed is mainly used to determine the scanning area or guide the generation of the target. This method is more suitable for large-scale scanning to find surviving IPv6 addresses. Although the address space generated by this method is large, the hit rate is low.

[0003] The present invention belongs to the second type of target address scanning method based on structural information. In the existing address generation method, the scanning area is guided by the ant colony algorithm. Summary of the invention

[0004] In order to solve the problems existing in the prior art, the present invention provides an IPv6 address scanning method based on ant colony splitting hierarchical clustering.

[0005] The technical solution adopted by the present invention is as follows: an ipv6 address scanning method based on ant colony splitting hierarchical clustering, which is characterized by the following steps:

[0006] Step 1) Perform split hierarchical clustering (DHC) on the seed address to generate a space tree, and then generate an address space, and initialize the parameters and formulas of the ant colony algorithm according to the address space information;

[0007] Initialize the address space information as the parameters and formulas of the ant colony algorithm:

[0008] b: the number of ants, the budget for scanning the address space; α: pheromone factor, the importance of pheromone in guiding the search of the ant colony; β: heuristic function factor, the relative importance of heuristic information in guiding the search of the ant colony; ρ: pheromone volatility factor, the disappearance level of pheromone; d: the number of unscanned addresses in the address space; τ: pheromone concentration: the proportion of active addresses in the detected address space = active addresses / number of space addresses; a: the number of active addresses obtained in an address space in one detection; s: the total number of addresses in an address space; P: the probability of choosing to expand the address space of a node; η: heuristic function, the value is The inverse of the number of unscanned address spaces; Allow: the set of nodes to be tested in the address space;

[0009]

[0010] The increment of pheromone concentration of an address space in this round of scanning is obtained by formula (1);

[0011] τ(t+1)=(1-ρ)τ(t)+τ (t≥2) (2)

[0012] The accumulated pheromone concentration of an address space is obtained by formula (2);

[0013]

[0014] The probability of selecting to expand the address space in the next round of scanning is obtained by formula (3), and then the order of the address space in the set of nodes to be tested is obtained.

[0015] Step 2) In the first round of scanning, the priority scanning area is selected according to the number of address spaces. After scanning the existing areas, the new address space is formed by continuing to aggregate;

[0016] 2.1) Selecting the first round of scanning area: Since the budget, i.e. the number of ants, is limited and there is a situation where the number of address spaces is large, the budget for each address space in each scan does not exceed 4096. In the first round of scanning, the τ of all address spaces is the same, which is 1. The order of selection of all address spaces is obtained by formula (3). The scanning area that is preferentially selected in the first round is the area with a smaller number of address spaces.

[0017] 2.2) Aggregate into new address space: Most of the address spaces scanned in the first round are relatively small, so after scanning, they are aggregated into new address spaces with larger address numbers and put into the node set Allow to be tested for the next scan.

[0018] Step 3) For the problem of too many addresses in the newly formed address space, based on the number of active addresses and address spaces obtained in the first round of scanning, the next round will give priority to scanning the address space with high pheromone in the ant colony algorithm, and then continue to aggregate upward to form a new address space;

[0019] 3.1) Calculation parameters: After the first round of scanning, a new address space is aggregated. The number of active addresses obtained in the first round of scanning is used as the number of active addresses aggregated into the new address space to calculate the pheromone concentration τ; the addresses scanned in the first round are no longer scanned in the second round, and the new address space is excluding the addresses scanned in the first round as d.

[0020] 3.2) Second round of scanning process: In the second round of scanning, the address space that has not been scanned in the allocated budget is put into the node set Allow to be tested as the address space to be scanned in the next round; the scanned address space continues to aggregate to form a new address space and put it into the node set Allow to be tested.

[0021] Step 4) According to the pheromone formula, the pheromone of the address space that has not been scanned is evaporated and then added to the pheromone calculated by the number of active addresses obtained in the previous round of scanning. Combined with step 3), the area for the third priority scan is selected; repeat the above steps until the budgeted number of ants is exhausted and the scan is terminated.

[0022] 4.1) The third round of scanning processing: According to formula (1) and formula (2), the pheromone concentration required for the third round of scanning is calculated. According to formula (3), the address space preferred for this scan is selected from the Allow set. The address space that has not been scanned is continued to be placed in the Allow set of nodes to be tested in the next round.

[0023] 4.2) Repeat steps 3) and 4) until the budget is exhausted or all address spaces are scanned.

[0024] The beneficial effects created by the present invention are as follows: The IPv6 address scanning method based on ant colony split hierarchical clustering proposed by the present invention has the following advantages: it can effectively solve the problems of low scanning efficiency, target space omission and unreasonable resource allocation in the existing methods, improve the scanning effect and resource utilization efficiency, and ensure the comprehensiveness and accuracy of the scan. And this method is suitable for scanning a large amount of data. When facing large-scale IPv6 address data, this method can maintain efficient and accurate scanning performance, avoid the situation of poor scanning effect due to the huge amount of data, thereby ensuring the scanning quality, realizing reasonable resource allocation, comprehensively covering the target space, and greatly improving the scanning efficiency. Compared with the more advanced target address scanning method based on structural information, the hit rate has been improved by more than 12%. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1The figure is a flow chart of the method of the present invention.

[0026] Figure 2 This is the IPv6 seed address processing page in the IPv6 asset discovery and vulnerability scanning system.

[0027] Figure 3 Generates pages for addresses in IPv6 asset discovery and vulnerability scanning systems.

[0028] Figure 4 This is the address extension record page for IPv6 asset discovery and vulnerability scanning systems.

[0029] Figure 5 Generates the active address results page for IPv6 asset discovery and vulnerability scanning systems. DETAILED DESCRIPTION

[0030] The present invention will be described in full below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0031] The ipv6 address scanning method based on ant colony split hierarchical clustering has the following steps:

[0032] Step 1) Perform divisive hierarchical clustering (DHC) on the seed addresses to generate a space tree, and then generate an address space, which is initialized as the parameters and formula of the ant colony algorithm based on the address space information.

[0033] Initialize the address space information as the parameters and formulas of the ant colony algorithm:

[0034] b: the number of ants, the budget for scanning the address space; α: pheromone factor, the importance of pheromone in guiding the search of the ant colony; β: heuristic function factor, the relative importance of heuristic information in guiding the search of the ant colony; ρ: pheromone volatility factor, the disappearance level of pheromone; d: the number of unscanned addresses in the address space; τ: pheromone concentration: the proportion of active addresses in the detected address space = active addresses / number of space addresses; a: the number of active addresses obtained in an address space in one detection; s: the total number of addresses in an address space; P: the probability of choosing to expand the address space of a node; η: heuristic function, the value is The inverse of the number of unscanned address spaces; Allow: the set of nodes to be tested in the address space;

[0035]

[0036] The increment of pheromone concentration of an address space in this round of scanning is obtained by formula (1);

[0037] τ(t+1)=(1-ρ)τ(t)+τ (t≥2) (2)

[0038] The accumulated pheromone concentration of an address space is obtained by formula (2);

[0039]

[0040] The probability of selecting to expand the address space in the next round of scanning is obtained by formula (3), and then the order of the address space in the set of nodes to be tested is obtained.

[0041] Step 2) In the first round of scanning, the priority scanning area is selected according to the number of address spaces. After scanning the existing areas, the new address space is formed by continuing to aggregate.

[0042] 2.1) Selecting the first round of scanning area: Since the budget, i.e. the number of ants, is limited and there is a situation where the number of address spaces is large, the budget for each address space in each scan does not exceed 4096. In the first round of scanning, τ of all address spaces is the same, which is 1. The probability of all address spaces being selected is obtained by formula (3). The scanning area that is preferentially selected in the first round is the area with a small number of address spaces.

[0043] 2.2) Aggregate into new address space: Most of the address spaces scanned in the first round are relatively small, so after scanning, they are aggregated into new address spaces with larger address numbers and put into the node set Allow to be tested for the next scan.

[0044] Step 3) For the problem of too many addresses in the newly formed address space, based on the number of active addresses and address spaces obtained in the first round of scanning, the next round will give priority to scanning the address space with high pheromone in the ant colony algorithm, and then continue to aggregate upward to form a new address space.

[0045] 3.1) Calculation parameters: After the first round of scanning, a new address space is aggregated. The number of active addresses obtained in the first round of scanning is used as the number of active addresses aggregated into the new address space to calculate the pheromone concentration τ; the addresses scanned in the first round are no longer scanned in the second round, and the new address space is excluding the addresses scanned in the first round as d.

[0046] 3.2) Second round of scanning process: In the second round of scanning, the address space that has not been scanned in the allocated budget is put into the node set Allow to be tested as the address space to be scanned in the next round; the scanned address space continues to aggregate to form a new address space and put it into the node set Allow to be tested.

[0047] Step 4) According to the pheromone formula, the pheromone of the address space that has not been scanned is evaporated and then added to the pheromone calculated by the number of active addresses obtained in the previous round of scanning. Combined with step 3, the area for the third priority scan is selected; repeat the above steps until the budget (number of ants) is exhausted and the scan is terminated.

[0048] 4.1) The third round of scanning processing: The pheromone concentration required for the third round of scanning is calculated according to Formula 1 and Formula 2, and the address space preferred for this scan is selected from the Allow set according to Formula 3. The address space that has not been scanned will continue to be placed in the Allow set of nodes to be tested in the next round.

[0049] 4.2) Repeat steps 3 and 4 until the budget is exhausted or all address spaces are scanned.

[0050] Embodiment 1:

[0051] The present invention creates an address prediction module applied to an IPv6 asset discovery and vulnerability scanning system, which generates more active IPv6 addresses according to the addresses in a seed address file. The specific application is as follows.

[0052] like Figure 2 As shown in the IPv6 seed address processing page, taking the ipv6addr.txt seed address of sequence number 3 as an example, by clicking "View" in the details, you can see the address information of the uploaded seed address file; click "Format" to convert the ipv6 address in the seed address file into a standard format; click "Set" in the survival detection to detect the survival of the address in the current seed address file; click "Address Extension" in the address generation to enter the address generation algorithm parameter customization page corresponding to the file.

[0053] like Figure 3 As shown in the address generation page, set the scan budget, pheromone factor and heuristic function factor to start calling this method to generate surviving IPv6 addresses.

[0054] like Figure 4 As shown in the address extension record page, you can see the extension record of ipv6addr.txt and the start time and end time of address generation for the seed address file in the address extension record. Click "View" to enter Figure 5 On the generated active address result page, you can see the generated active IPv6 addresses. In addition, you can also perform alias zone training on the generated results to remove the alias addresses from the generated active addresses.

Claims

1. An IPv6 address scanning method based on ant colony splitting hierarchical clustering, characterized in that: The steps are: Step 1) Perform split hierarchical clustering (DHC) on the seed address to generate a space tree, and then generate an address space, and initialize the parameters and formulas of the ant colony algorithm according to the address space information; Step 2) In the first round of scanning, the priority scanning area is selected according to the number of address spaces. After scanning the existing areas, the new address space is formed by continuing to aggregate; Step 3) For the problem of too many addresses in the newly formed address space, based on the number of active addresses and address spaces obtained in the first round of scanning, the next round will give priority to scanning the address space with high pheromone in the ant colony algorithm, and then continue to aggregate upward to form a new address space; Step 4) According to the pheromone formula, the pheromone of the address space that has not been scanned is evaporated and then added to the pheromone calculated by the number of active addresses obtained in the previous round of scanning. Combined with step 3), the area for the third priority scan is selected; repeat the above steps until the budgeted number of ants is exhausted and the scan is terminated.

2. The ipv6 address scanning method based on ant colony splitting hierarchical clustering according to claim 1 is characterized in that: In the step 1), the specific method is: Initialize the address space information as the parameters and formula of the ant colony algorithm: b: number of ants, the budget for scanning address space; α: pheromone factor, the importance of pheromone in guiding ant colony search; β: heuristic function factor, the relative importance of heuristic information in guiding ant colony search; ρ: pheromone volatility factor, the disappearance level of pheromone; d: the number of unscanned addresses in the address space; τ: pheromone concentration: the proportion of active addresses in the detected address space = active addresses / number of addresses in the space; a: the number of active addresses obtained in an address space in one detection; s: the total number of addresses in an address space; P: the probability of choosing to expand the address space of a certain node; η: Heuristic function, value is The inverse of the number of unscanned address spaces; Allow: the set of nodes to be tested in the address space; The increment of pheromone concentration of an address space in this round of scanning is obtained by formula (1); τ(t+1)=(1-ρ)τ(t)+τ (t≥2) (2) The accumulated pheromone concentration of an address space is obtained by formula (2); The probability of selecting to expand the address space in the next round of scanning is obtained by formula (3), and then the order of the address space in the set of nodes to be tested is obtained.

3. The ipv6 address scanning method based on ant colony splitting hierarchical clustering according to claim 2 is characterized in that: In the step 2), the specific method is: 2.1) Selecting the first round of scanning area: Since the budget, i.e. the number of ants, is limited and there is a situation where the number of address spaces is large, the budget for each address space in each scan does not exceed 4096. In the first round of scanning, the τ of all address spaces is the same, which is 1. The order of selection of all address spaces is obtained by formula (3). The scanning area that is preferentially selected in the first round is the area with a smaller number of address spaces. 2.2) Aggregate into new address space: Most of the address spaces scanned in the first round are relatively small, so after scanning, they are aggregated into new address spaces with larger address numbers and put into the node set Allow to be tested for the next scan.

4. The ipv6 address scanning method based on ant colony splitting hierarchical clustering according to claim 2 is characterized in that: In the step 3), the specific method is: 3.1) Calculation parameters: After the first round of scanning, a new address space is aggregated. The number of active addresses obtained in the first round of scanning is used as the number of active addresses aggregated into the new address space to calculate the pheromone concentration τ; the addresses scanned in the first round are no longer scanned in the second round, and the new address space is excluding the addresses scanned in the first round as d. 3.2) Second round of scanning process: In the second round of scanning, the address space that has not been scanned in the allocated budget is put into the node set Allow to be tested as the address space to be scanned in the next round; the scanned address space continues to aggregate to form a new address space and put it into the node set Allow to be tested.

5. The ipv6 address scanning method based on ant colony splitting hierarchical clustering according to claim 2 is characterized in that: In the step 4), the specific method is: 4.1) The third round of scanning processing: According to formula (1) and formula (2), the pheromone concentration required for the third round of scanning is calculated. According to formula (3), the address space preferred for this scan is selected from the Allow set. The address space that has not been scanned is continued to be placed in the Allow set of nodes to be tested in the next round. 4.2) Repeat steps 3) and 4) until the budget is exhausted or all address spaces are scanned.

Images