IPv6 address prediction method and system based on double space trees

Abstract

The invention relates to the technical field of network space security, in particular to an IPv6 address prediction method and system based on a double-space tree, and the method comprises the steps: dividing an address seed set into seed address subsets of different BGP prefix spaces according to an open-source BGP prefix list; generating a double-address space tree by taking the seed address subset of each BPG prefix space as a unit; extracting leaf nodes in the prefix space tree and the suffix space tree and splicing the leaf nodes in the prefix space tree and the suffix space tree to generate a candidate address mode; and according to the number of the seed addresses in the BGP prefix space, carrying out descending sort on the BGP prefixes and setting address generation priorities, so as to carry out address generation in the corresponding BGP prefix space according to the sequence of the address generation priorities, and obtaining a candidate address set in the corresponding BGP prefix space through address alias deletion. According to the method, active addresses and more / 64 active address prefixes can be found more efficiently, scanning of a large number of possibly inactive addresses in a BGP prefix space is avoided, and the efficiency of an IPv6 address prediction process is improved.

Description

Technical Field

[0001] The present invention relates to the field of network space security technology, and in particular to an IPv6 address prediction method and system based on a dual space tree. Background Art

[0002] Active address scanning is a prerequisite for Internet-scale network investigation and measurement. It is part of network security assessment and can help detect potential vulnerability threats in the network, understand the behavior of threat actors, and ensure the safe operation of the network. The degree of change in the IP address assigned to the host is affected by time. Active address scanning tracks the changes in spatial addresses over time, and conducts dynamic analysis of address space to explore the characteristics of IPv6 address allocation. At the same time, active address scanning supports network topology detection, which is critical for building an accurate network topology map. Understanding the connection relationship between devices in the network and understanding the network structure are the basis for effective management and maintenance of network operation. Active address scanning analyzes the geographical distribution of devices based on IP address segments and geographic location databases, understands the geographical distribution of network devices, and helps implement geographic location restrictions and regional access control to enhance network security. In general, Internet-scale active address scanning is of great significance for network asset management, IP address analysis, geolocation, and network topology discovery.

[0003] In traditional IPv4 Internet scanning, high-speed asynchronous scanning tools ZMap and Masscan can effectively perform Internet-wide IPv4 address scanning. ZMap can traverse and scan the entire IPv4 address space within 45 minutes. Network device search engines such as Shodan and Censys can obtain Internet-wide asset data. Internet-wide IPv4 address scanning is already very popular, while Internet-wide IPv6 address scanning is not common. The reason is that these tools are difficult to meet actual needs when faced with the huge IPv6 address space. Even if ZMap is used in the highest configuration mode, it will take millions of years to scan.

[0004] To this end, researchers proposed IPv6 address prediction technology, which can greatly improve the scanning efficiency of active IPv6 addresses by learning the statistical information and structural information of surviving or once surviving IPv6 seed addresses and then predicting and generating more likely active IPv6 target addresses. The current IPv6 address prediction algorithm has the following problems: 1. Low hit rate: IPv6 addresses are composed of two parts, prefix and suffix, which are logically independent and have different functions. However, when mining structural information, existing IPv6 address prediction algorithms often treat the entire 128-bit IPv6 address as a whole, ignoring its inherent logical structure, resulting in a relatively low algorithm hit rate. 2. Limited sub-prefix space coverage: Existing algorithms often predict uneven distribution of IPv6 addresses, ignoring more potential sub-prefix spaces within the seed prefix. This limitation results in the prediction results being limited to a few / 64 sub-prefixes, failing to cover a wider range of IPv6 address space. 3. Limitations of metrics: At present, the evaluation criteria of most algorithms mainly focus on the hit rate of active IPv6 addresses, ignoring the unique structural characteristics of IPv6 addresses themselves. For example, the / 64 prefixes that are typically assigned to individual end sites are not taken into account as an important measurement dimension, which limits the accuracy of the algorithm in assessing the breadth of IPv6 address distribution. Summary of the invention

[0005] To this end, the present invention provides an IPv6 address prediction method and system based on a dual space tree, which solves the problems of low hit rate and insufficient sub-prefix coverage in the existing IPv6 address prediction technology.

[0006] According to the design scheme provided by the present invention, on the one hand, a dual-space tree-based IPv6 address prediction method is provided, comprising:

[0007] Get the target area IPv6 address seed set;

[0008] According to the open source Border Gateway Protocol BGP prefix list, the address seed set is divided into seed address subsets of different BGP prefix spaces, and a dual address space tree is generated based on the seed address subset of each BPG prefix space, wherein the dual address space tree includes a prefix space tree generated based on the prefix part of the seed address and a suffix space tree generated based on the suffix part of the seed address;

[0009] Extract leaf nodes from both the prefix space tree and the suffix space tree and concatenate the leaf nodes of the two to generate a candidate address pattern;

[0010] The BGP prefixes are arranged in descending order according to the number of seed addresses in the BGP prefix space and the address generation priority is set, so that addresses are generated in the corresponding BGP prefix space according to the address generation priority order, and the candidate address set in the corresponding BGP prefix space is obtained by deleting the address alias.

[0011] As the IPv6 address prediction method based on the dual space tree of the present invention, further, a dual address space tree is generated with a seed address subset of each BPG prefix space as a unit, including:

[0012] Divide the seed addresses in the seed address subset into a prefix part and a suffix part, and form a prefix part list and a suffix part list;

[0013] For the prefix partial list and the suffix partial list, the minimum entropy partitioning strategy is used to perform regional division to construct the corresponding prefix space tree and suffix space tree. The minimum entropy partitioning strategy is to perform regional division by finding the dimension with the smallest entropy value each time the space is divided, wherein the entropy value is used to measure the value distribution of the address in different dimensions.

[0014] As the IPv6 address prediction method based on the dual space tree of the present invention, further, the minimum entropy segmentation strategy is used to perform regional division, including:

[0015] The prefix partial list and the suffix partial list use the divisive hierarchical clustering algorithm DHC to determine the location of the split indicator and divide the space. The split indicator is determined by the minimum entropy strategy;

[0016] The divisive hierarchical clustering algorithm DHC is used to iteratively divide the child nodes until the number of address vectors corresponding to the node is less than the threshold or the node dimension is the specified value, and the nodes that are not further divided are regarded as leaf nodes.

[0017] As the IPv6 address prediction method based on dual space trees of the present invention, further, extracting leaf nodes in both the prefix space tree and the suffix space tree and splicing the leaf nodes of the two, comprising:

[0018] Extract leaf nodes in the suffix space tree, mine the interface identifier IID address pattern and count the frequency value, where the frequency value is used to represent the number of seed addresses belonging to the current IID address pattern;

[0019] Based on the DHC IID address pattern and the frequency IID pattern, a candidate IID address pattern is formed through a pattern refinement strategy;

[0020] Arrange the frequency values ​​of the candidate IID address pattern list in descending order, delete the IID patterns whose frequency values ​​are lower than the specified threshold, and select the IID patterns with the top K frequency values ​​from the candidate IID address patterns as high-density IID patterns;

[0021] Extract leaf nodes in the prefix space tree to mine prefix address patterns;

[0022] The high-density IID pattern and the prefix address pattern are traversally combined and spliced ​​to obtain a candidate address pattern.

[0023] As the IPv6 address prediction method based on the dual space tree of the present invention, further, address pattern mining includes:

[0024] For the seed address contained in the tree child node of the address space tree, if the seed address dimension value is not unique, a wildcard is used to represent the variable dimension of the address mode, and the number of wildcards is used to represent the current address mode variable dimension value.

[0025] As the IPv6 address prediction method based on the dual space tree of the present invention, further, the frequency value is counted, including:

[0026] For the mined address pattern, the address pattern with a variable dimension of zero is used as the IID frequency pattern, so as to use the IID frequency pattern to count the IID frequency pattern frequency value, wherein the variable dimension is used to indicate that the dimension in the address vector has different values.

[0027] As the IPv6 address prediction method based on the dual space tree of the present invention, further, the candidate address set in the corresponding BGP prefix space is obtained by deleting the address alias, including:

[0028] Obtain an open source alias prefix list, wherein the alias prefix list stores network prefixes of multiple alias addresses pointing to the same interface;

[0029] The alias prefix list is used to filter and delete the generated addresses to obtain a final set of candidate target addresses.

[0030] On the other hand, the present invention also provides an IPv6 address prediction system based on a dual-space tree, comprising: a seed address collection module, a dual-space tree construction module, an address pattern generation module and a target address output module, wherein:

[0031] A seed address collection module is used to obtain a target area IPv6 address seed set;

[0032] A dual-space tree construction module, used to divide the address seed set into seed address subsets of different BGP prefix spaces according to the open source Border Gateway Protocol BGP prefix list, and generate a dual-address space tree based on the seed address subset of each BPG prefix space, wherein the dual-address space tree includes a prefix space tree generated based on the prefix part of the seed address in the seed address subset and a suffix space tree generated based on the suffix part of the seed address in the seed address subset;

[0033] An address pattern generation module, used for extracting leaf nodes from both the prefix space tree and the suffix space tree and concatenating the leaf nodes of the two to generate a candidate address pattern;

[0034] The target address output module is used to arrange the BGP prefixes in descending order according to the number of seed addresses in the BGP prefix space and set the address generation priority, so as to generate addresses in the corresponding BGP prefix space according to the address generation priority order, and obtain the candidate address set in the corresponding BGP prefix space by deleting the address alias.

[0035] Beneficial effects of the present invention:

[0036] The present invention divides the IPv6 address into two parts: the prefix (the first 64 bits) and the suffix (the last 64 bits), and performs address pattern mining and refinement in the border gateway protocol BGP prefix space, which can achieve fine-grained and extensive address prediction in the seed prefix space, and can more efficiently discover active addresses and more / 64 active address prefixes, effectively avoiding scanning a large number of potentially inactive addresses in the BGP prefix space, and improving the efficiency of the IPv6 address prediction process. Further experimental results show that under limited budget conditions, the hit rate of this solution reaches 47.05% to 63.53%. Compared with the existing 7 algorithms such as 6Forest and 6Graph, this solution has an average improvement of 54.92% in the number of active addresses found and an average improvement of 60.25% in the number of active / 64 prefixes found, and has good application prospects in the fields of cyberspace assets / security. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is a schematic diagram of the IPv6 address prediction process based on the dual space tree in the embodiment;

[0038] Figure 2 The following is a schematic diagram of the architecture of the IPv6 address prediction tool DoubleTree based on the dual space tree in the embodiment;

[0039] Figure 3 This is a schematic diagram of constructing a space tree for the suffix part in the embodiment;

[0040] Figure 4 This is a schematic diagram of the IID mode refinement in the embodiment;

[0041] Figure 5 This is a schematic diagram of splicing prefix and suffix address modes in the embodiment;

[0042] Figure 6 This is a schematic diagram of the BGP prefix distribution of the seed address set in the embodiment;

[0043] Figure 7This is a schematic diagram of the correlation response analysis of the seed set to the common upper layer protocols in the embodiment;

[0044] Figure 8 This is a schematic diagram of the number of prefix patterns generated by different seed set segmentation strategies in the embodiment;

[0045] Fig. 9 This is a comparison diagram of the hit rate of active addresses on the seed set in the embodiment;

[0046] Fig.10 The figure is a schematic diagram of the correlation response analysis of candidate addresses to common protocols in the embodiment. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below in conjunction with the accompanying drawings and technical solutions.

[0048] Before introducing the solution of this case, the following relevant terms are explained in the solution:

[0049] IPv6 address vector: A 128-bit binary IPv6 address a is converted into a 32-bit hexadecimal IPv6 address vector x. Each bit of vector x has a value in the range [0, f].

[0050] Variable dimensions and fixed dimensions: When the dimension has different values, the wildcard * is used to indicate a variable dimension. If the dimension value is any value in the hexadecimal system [0, f], the dimension is a fixed dimension.

[0051] Address pattern mining: For the seed addresses contained in the leaf nodes of the address space tree, when the value of a dimension is not a unique value, the dimension is a variable dimension, represented by *, and the number of wildcards * represents the variable dimension value v of the pattern.

[0052] Detecting address space: When generating an address space tree for pattern mining, an address pattern is formed. The magnitude of the address space to be detected is 16 v An address pattern like this: 20010558fe320***000000000000000* can generate 16 4 IPv6 target addresses are available for detection.

[0053] Frequency value: In the pattern mining stage, the IID pattern list is formed by two methods: dynamic host configuration DHC and address frequency. The frequency value is defined as the number of seed addresses in the pattern.

[0054] Address region density: For a seed region or address pattern P and seed set S with variable dimension μ, the corresponding density is P.density = S.size() / μ

[0055] Entropy value: The IPv6 address vector consists of 32 hexadecimal bits, and the entropy value of the kth bit is H(X j ) is calculated as:

[0056] Indicates that the value of the kth nibble of the address is The value set Q of is {0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f}, 16 possible values, P(X k ) indicates that the value is X k The probability that H(X j )=0, it means that the value of the kth half byte of the seed address is unique. j )=1, it means that the seed address takes all values ​​in set Q in the kth half byte, and the probability is the same.

[0057] Active address hit rate: The hit rate can be defined as the ratio of active addresses generated by the algorithm to the total number of candidate addresses generated. The calculation formula is R hit =N active / N candidate .

[0058] The discovery and management of network assets are crucial to network security. Existing IPv6 address prediction technologies have problems such as low hit rate and insufficient sub-prefix coverage. To this end, an embodiment of the present invention provides an IPv6 address prediction method based on a dual space tree, such as Figure 1 As shown, including:

[0059] S101, obtaining a target area IPv6 address seed set;

[0060] S102, dividing the address seed set into seed address subsets of different BGP prefix spaces according to the open source Border Gateway Protocol BGP prefix list, generating a dual address space tree based on the seed address subset of each BGP prefix space, wherein the dual address space tree includes a prefix space tree generated based on the prefix part of the seed address in the seed address subset and a suffix space tree generated based on the suffix part of the seed address in the seed address subset;

[0061] S103, extracting leaf nodes from both the prefix space tree and the suffix space tree and concatenating the leaf nodes of the two to generate a candidate address pattern;

[0062] S104. Arrange the BGP prefixes in descending order according to the number of seed addresses in the BGP prefix space and set the address generation priority, so as to generate addresses in the corresponding BGP prefix space according to the address generation priority order, and obtain a candidate address set in the corresponding BGP prefix space by deleting the address alias.

[0063] By analyzing the IPv6 address prefix structure and the suffix part (i.e., the interface identifier IID part) allocation strategy in the BGP prefix space, and predicting and generating IPv6 active target addresses based on the dual-space tree structure, more / 64 sub-prefix spaces can be explored and active addresses can be discovered efficiently.

[0064] The address prediction tool 6DoubleTree architecture built based on this case solution is as follows Figure 2 As shown in the figure, the seed address set is divided into different BGP prefix areas using a public BGP prefix list. In the BGP prefix space, the last 64 bits of the IID part of the active IPv6 address are more consistent with a certain pattern rule to obtain an IID pattern with a higher density in the BGP prefix space. 6DoubleTree combines the address patterns formed by the leaf nodes of the address space tree, that is, the prefix pattern and the high-density IID pattern are spliced ​​together to form a candidate address pattern for subsequent IPv6 address generation. High-density seed areas are more likely to find active addresses, and the proportion of seed addresses in the BGP prefix space reflects the density distribution of active IPv6 addresses in the real network environment to a certain extent. In the process of IPv6 address generation, 6DoubleTree arranges the BGP prefix areas in descending order according to the seed address density, and gives priority to address generation in high-density BGP prefix areas to avoid wasting detection resources.

[0065] The dual address space tree is generated based on the seed address subset of each BPG prefix space, and can be designed to include:

[0066] Divide the seed addresses in the seed address subset into a prefix part and a suffix part, and form a prefix part list and a suffix part list;

[0067] For the prefix partial list and the suffix partial list, the minimum entropy partitioning strategy is used to perform regional division to construct the corresponding prefix space tree and suffix space tree. The minimum entropy partitioning strategy is to perform regional division by finding the dimension with the smallest entropy value each time the space is divided, wherein the entropy value is used to measure the value distribution of the address in different dimensions.

[0068] Based on the different purposes of the prefix and suffix parts, in the embodiment of this case, consideration is given to how to divide the two parts into regions to construct a space tree.

[0069] In the prefix part, the purpose of 6DoubleTree is to mine as many prefix patterns as possible in the seed prefix and explore a wider sub-prefix space of the seed prefix space. The minimum entropy partitioning strategy has the greatest advantage in the number of prefix patterns. In the prefix part, the minimum entropy partitioning strategy is selected for region partitioning to construct the space tree.

[0070] In the suffix part, the purpose of 6DoubleTree is to mine high-density IID patterns and obtain high-density IID patterns in the BGP prefix space to ensure that the target address is as active as possible. Among the existing algorithms' spatial tree partitioning strategies, the minimum entropy partitioning strategy can avoid partitioning high-density areas and ensure that high-density areas are located in the leaf nodes or the same branch of the spatial tree. In the suffix part, the minimum entropy partitioning strategy is also selected for regional partitioning to construct a spatial tree. The spatial tree construction example is as follows: Figure 3 As shown, the construction principle of the prefix part space tree is the same as that in the example.

[0071] The dual space tree construction algorithm is shown in Algorithm 1:

[0072]

[0073] Algorithm 1 describes the basic logic of constructing a dual-space tree, vectorizing the seed address set, and initializing the root node root, which represents the entire seed address set. The addresses of the seed address set are divided into two lists: the 0-15-bit prefix part and the 16-32-bit suffix part. DHC is performed on each of them. The split indicator split_index is determined by the minimum entropy method. DHC is performed on the child nodes iteratively until the number of address vectors corresponding to the node is less than the threshold δ or the node dimension is 1. Nodes that are not further divided are called leaf nodes, which store high-density address patterns.

[0074] Among them, extracting leaf nodes from both the prefix space tree and the suffix space tree and concatenating the leaf nodes of the two can be designed to include:

[0075] Extract leaf nodes in the suffix space tree, mine the interface identifier IID address pattern and count the frequency value, where the frequency value is used to represent the number of seed addresses belonging to the current IID address pattern;

[0076] Forming a candidate IID address pattern based on the IID address pattern and the IID frequency pattern of the DHC;

[0077] Arrange the frequency values ​​of the candidate IID address pattern list in descending order, delete the IID patterns whose frequency values ​​are lower than the specified threshold, and select the IID patterns with the top K frequency values ​​from the candidate IID address patterns as high-density IID patterns;

[0078] Extract leaf nodes in the prefix space tree to mine prefix address patterns;

[0079] The high-density IID pattern and the prefix address pattern are traversally combined and spliced ​​to obtain a candidate address pattern.

[0080] For the seed address contained in the tree child node of the address space tree, if the seed address dimension value is not unique, a wildcard can be used to represent the seed address dimension, and the number of wildcards can be used to represent the variable dimension value of the current address mode.

[0081] For the mined address pattern, the address pattern with a variable dimension of zero is used as the IID frequency pattern, so as to use the IID frequency pattern to count the IID frequency pattern frequency value, wherein the variable dimension is used to indicate that the dimension in the address vector has different values.

[0082] like Figure 2 As shown, 6DoubleTree adopts certain rules to refine the suffix (IID) pattern. Specifically, 6DoubleTree performs frequency statistics on the regional seed addresses, counts the frequency values ​​of the IID frequency pattern (that is, the address pattern with a variable dimension of zero) and arranges them in descending order. 6DoubleTree extracts the leaf nodes of the suffix part of the space tree, mines the DHC-IID pattern (that is, the IID address pattern formed by DHC) and counts the frequency value, and takes the union of the mined DHC-IID pattern and the IID frequency pattern to form a candidate IID address pattern. The frequency value represents the number of seed addresses belonging to the pattern.

[0083] A specific example of IID model refinement is as follows: Figure 4 As shown in the figure, the frequency value of the DHC-IID pattern "00ff:00ff:00ff:00f*" is 64. In the IID frequency pattern list, the frequency values ​​of "00ff:00ff:00ff:00ff" and "00ff:00ff:00ff:00fe" are 34 and 25, which almost cover all the seed addresses of the "00ff:00ff:00ff:00f*" pattern. However, IID frequency patterns with very few occurrences are included in the DHC-IID pattern, such as "00ff:00ff:00ff:00fa" with a frequency value of 5, which increases the dimension of the DHC-IID address pattern and expands the address scanning space.

[0084] In order to obtain high-density IID patterns in the BGP prefix space, 6DoubleTree sorts the candidate IID address pattern list in descending order of frequency values ​​and deletes IID patterns with frequency values ​​lower than 10. Such patterns cannot significantly represent the logical law of IPv6 address IID allocation in the BGP prefix space. Finally, 6DoubleTree takes the top 5 high-density IID patterns in the candidate IID address pattern for subsequent combination and splicing with the prefix pattern. 6DoubleTree effectively reduces the dimension of the IID pattern, reduces unnecessary scanning space, and improves scanning efficiency. Algorithm 2 describes the basic logic of candidate address pattern construction:

[0085]

[0086] 6DoubleTree extracts the address patterns of the leaf nodes of the prefix and suffix parts, and performs a pattern refinement strategy on the suffix pattern to obtain the IID pattern, where the two variables suffixes and iid_fre_pattern represent the DHC-IID pattern and the IID frequency pattern respectively. During the splicing process, 6DoubleTree performs a traversal combination of the top 5 IID patterns with the prefix pattern to obtain a complete candidate address pattern, which is used to generate the target address. The example of splicing the prefix and suffix address patterns is as follows: Figure 5 shown.

[0087] 6DoubleTree focuses on the IID allocation rules and the number of prefix patterns in the BGP prefix space to predict IPv6 addresses, and does not design complex target address generation strategies. IPv6 addresses are more likely to be active in a denser BGP prefix space, so 6Double generates IPv6 addresses according to the BGP prefix space density and removes alias addresses from the target address to avoid scanning alias addresses.

[0088] 6DoubleTree sorts BGP prefixes according to the number of seed addresses in the BGP prefix space, generates a double-space tree and builds a candidate address model based on the seed address set of each BGP prefix space, and prioritizes the allocation of budgets in high-density BGP prefix spaces for target address generation. The generated target addresses conform to the address space density distribution. Finally, the target address is aliased to obtain a candidate address set.

[0089] The candidate address set in the corresponding BGP prefix space is obtained by deleting the address alias, which may include:

[0090] Obtain an open source alias prefix list, wherein the alias prefix list stores multiple alias addresses pointing to the same interface;

[0091] The alias prefix list is used to filter and delete the generated addresses to obtain a final set of candidate target addresses.

[0092] Furthermore, based on the above method, an embodiment of the present invention also provides an IPv6 address prediction system based on a dual-space tree, comprising: a seed address collection module, a dual-space tree construction module, an address pattern generation module and a target address output module, wherein:

[0093] A seed address collection module is used to obtain a target area IPv6 address seed set;

[0094] A dual-space tree construction module, used to divide the address seed set into seed address subsets of different BGP prefix spaces according to the open source Border Gateway Protocol BGP prefix list, and generate a dual-address space tree based on the seed address subset of each BPG prefix space, wherein the dual-address space tree includes a prefix space tree generated based on the prefix part of the seed address in the seed address subset and a suffix space tree generated based on the suffix part of the seed address in the seed address subset;

[0095] An address pattern generation module, used for extracting leaf nodes from both the prefix space tree and the suffix space tree and concatenating the leaf nodes of the two to generate a candidate address pattern;

[0096] The target address output module is used to arrange the BGP prefixes in descending order according to the number of seed addresses in the BGP prefix space and set the address generation priority, so as to generate addresses in the corresponding BGP prefix space according to the address generation priority order, and obtain the candidate address set in the corresponding BGP prefix space by deleting the address alias.

[0097] In order to verify the effectiveness of this solution, the following is a further explanation based on experimental data:

[0098] Gasser et al. collected active IPv6 addresses including servers, routers, and clients through multiple channels and constructed a public IPv6 Hitlist data source. This work made the IPv6 Hitlist service public in 2018, and Zirngibl et al. updated and improved the service quality. The experiment obtained non-alias address data on March 16, 2024, which included 18,488,319 globally active IPv6 addresses as address set C0. Through statistics from the Pyasn database, it was found that the covered BGP prefixes were 71,154 and the number of ASs was 21,392. The address data source is shown in Table 1.

[0099] Table 1 IPv6 address data source

[0100]

[0101] The downsampling method can construct a distribution that is more consistent with the hitlist address data set as much as possible. The balanced seed data set more realistically reflects the density distribution of IPv6 addresses in the prefix space, and generates more possible active IPv6 addresses in the region based on the spatial density and seed address structure characteristics. Therefore, 25k, 50k, and 0.1M addresses are randomly selected from C0 to form C1, C2, and C3 balanced IPv6 address seed sets to support subsequent experimental measurements. The seed set information is shown in Table 2.

[0102] Table 2 IPv6 seed address set information

[0103]

[0104] Experimental environment: An Internet-wide scanning experiment was conducted in July 2024, limiting the detection rate to 30Mbps to strictly ensure the network impact on Internet users. The scanner using ICMPv6 probes was deployed on an Ubuntu 22.04 platform with a 4-core 2.60GHz Intel Core processor, 8GB RAM, and a 500Mbps bandwidth network card.

[0105] Pyasn is a Python extension module developed by Hadi Asghari and Dr. Arman Noroozian of Delft University of Technology during their work on network security measurements. It can efficiently look up IP addresses to AS autonomous system numbers. The experiment uses the Pyasn module to obtain the Pyasn database containing 209,580 IPv6 BGP routable prefixes as of March 20, 2024.

[0106] Figure 6 The prefix distribution of IPv6 Hitlist, C1, C2, and C3 seed sets is shown, where the horizontal axis is the number of BGP prefixes and the vertical axis is the proportion of seed addresses in the current prefix to the total number of seeds. The number of seeds in the first 10 BGP prefixes accounts for nearly 30% (point A), the number of seed addresses in the first 100 BGP prefixes exceeds 60% (point B), and the number of seed addresses in the first 1000 BGP prefixes accounts for more than 85% of the total (point C). It can be seen that the distribution of IPv6 seed address sets in these prefixes is extremely uneven, and the addresses of the seed address set are distributed in the high-density BGP prefix area. At the same time, the density distribution of the seed sets C1, C2, and C3 selected in the experiment is similar to that of IPv6 Hitlist, and the density of the data set also meets the purpose of 6DoubleTree to generate target addresses based on the BGP prefix space.

[0107] Figure 7The relevant responses of the C0 seed set addresses to common protocols are shown, including ICMPv6, TCP / 21, TCP / 22, TCP / 23, TCP / 80, TCP / 110, TCP / 443, TCP / 8080, UDP / 53 and UDP / 443. As shown in the heat map, the numbers represent the probability of responding to protocol Y under the condition of responding to protocol X. Among them, it can be seen from the first row of data that if the host responds to any other protocol, at least 86.96% of IPv6 addresses respond to ICMPv6, so ICMPv6 is an important means of verifying the activeness of IPv6 active addresses. In order to reduce the consumption of network resources in the experimental measurement, only ICMPv6 echo requests (Echo Request) are sent throughout the experiment to detect whether the target address is in an active state.

[0108] Most address prediction algorithms use the leftmost split strategy to construct space trees, such as 6Tree, 6Scan, etc. When clustering and dividing regions, they look for the first dimension in the address list that has different values ​​from the left as the split indicator position for splitting.

[0109] The DET algorithm proposes a minimum entropy segmentation strategy, which seeks the dimension with the smallest entropy value for segmentation each time it performs spatial segmentation, avoiding segmentation of high-density areas to the greatest extent and ensuring that high-density areas are located in the same branch of the leaf node or spatial tree. Minimum density loss is achieved by dividing the current seed set in the dimension with the minimum entropy value.

[0110] 6Forest proposes a new metric to evaluate the priority of the partitioning dimension, namely the covering number, which represents the number of non-unique nibbles of all seeds on a given dimension. The partition indicator selects the dimension with the largest covering number as the dimension for the subspace partition, that is, the maximum covering partitioning strategy. Seeds with the same nibbles on this dimension will be divided into a cluster, which is the least affected by outlier seeds.

[0111] Different space tree segmentation strategies affect the density of the address space area, and the number of address patterns mined by the constructed space tree is also different. The prefix minimum entropy segmentation strategy, prefix leftmost segmentation strategy and prefix maximum coverage strategy are run on the three seed address sets C1, C2 and C3 respectively, and the number of prefix address patterns mined is compared.

[0112] The pattern dimension is closely related to the quality of the generated target address and the data scale. In the process of pattern mining, the address prediction algorithm will increase the address space and the number of generated addresses exponentially when the dimension increases, which increases the uncertainty and low activity of the address. Therefore, the variable dimension is controlled below 5. Under the condition of dimension ≤ 4, such as Figure 8As shown, min, left, and max represent the minimum entropy, leftmost, and maximum coverage segmentation strategies respectively. The total number of prefix patterns obtained by the minimum entropy strategy on different seed sets is 8.92%-13.18% more than that of the leftmost strategy, and 4.91%-13.10% more than that of the maximum coverage strategy.

[0113] Explore the number of patterns generated in the prefix part under different segmentation strategies. Mining more prefix patterns means that more address space in the prefix area can be explored. Therefore, the minimum entropy segmentation strategy can be selected in the prefix part.

[0114] Explore the effect comparison between 6DoubleTree and current mainstream algorithms. Run and evaluate the 9 algorithms listed in Table 3 for comparison. Among them, Entropy / IP is not suitable for inputs larger than 0.1M addresses, and the experimental seed data set scale is in line with it. Since the public source code of 6Graph and 6Forest does not contain the part of generating target addresses, the target address generation method based on Hamming distance is used to construct candidate sets for 6Graph and 6Forest for subsequent experiments.

[0115] In the 6GCVAE algorithm experiment, the source code parameters are kept unchanged and the seed address vector is input for model training. The algorithm generation address budget is adjusted by setting "generation_number".

[0116] The experiment used C1, C2, and C3 seed sets as algorithm inputs, and set the budget to 200 times the input seed size, i.e., 5M, 10M, and 20M. According to the budget, the candidate address set was successfully generated, and the data cleaning phase of data deduplication and alias screening was performed. The candidate address set was used as the input of the ZMapv6 asynchronous scanning tool, and the ICMPv6 protocol was used to detect active addresses. The prefixes of the obtained active addresses were extracted and deduplicated to obtain the number of active / 64 prefixes. Table 3 shows the comparison of the number of active addresses generated by 6DoubleTree and the typical algorithm under the same budget.

[0117] Table 3 Comparison of the number of active addresses with typical IPv6 address prediction algorithms

[0118]

[0119] Comparison of active address hit rates Fig. 9As shown in the figure. The IPv6 address prediction algorithms based on deep learning such as 6GCVAE are not sufficient for IPv6 address prediction tasks with a large budget. The time cost is high and the prediction effect is poor in the training model stage. Entropy / IP is a typical address prediction algorithm based on seed statistical information. It generates targets based on the distribution law of address values ​​in different nibbles. However, its time complexity is high and it is also not suitable for large-scale address prediction work. The 6DoubleTree algorithm mainly predicts IPv6 addresses based on seed address structure information. Therefore, compared with the other 7 address prediction algorithms based on seed structure information, under the same budget, compared with 6Forest, 6Graph and other 7 algorithms based on seed address structure information, 6DoubleTree has an average increase of 54.92% in the number of active addresses found, and the active address hit rate has reached 47.05% to 63.53%.

[0120] After obtaining the active IPv6 addresses by probing the candidate address set through the ICMPv6 protocol, the first 64 bits of the active addresses are extracted, and the number of active / 64 prefixes obtained by 6DoubleTree and other algorithms on the seed sets C1, C2, and C3 are counted and compared. The specific statistical information is shown in Table 4.

[0121] Table 4 Comparison of the number of active / 64 prefixes with typical IPv6 address prediction algorithms

[0122]

[0123] In terms of the number of active / 64 prefixes, 6DoubleTree is also better than most typical algorithms, exploring more sub-prefix spaces in BGP prefixes. Compared with 7 algorithms such as 6Forest and 6Graph, 6DoubleTree improves by 18.97% to 192.05%.

[0124] Among them, 6Gen in dataset C3 and HMap6 in dataset C1 have the best results in obtaining the number of active / 64 prefixes, which is due to the differences between the two clustering methods of AHC and DHC. Among them, 6Gen is an AHC hierarchical clustering method, and HMap6 uses the address mode of DHC+AHC clustering to generate the target address, and most of the modes are obtained by AHC clustering. This is due to the bottom-up characteristics of the AHC clustering method. Under a certain generation budget, it can explore more sub-prefix areas.

[0125] Fig.10 The figure shows the relative responses of the target IPv6 addresses discovered by 6DoubleTree for the input C3 seed set to common protocols. It is found that there is a strong correlation between the services provided by IPv6 hosts, and the responsiveness of the discovered target addresses is similar to Figure 7Seed-related responsiveness. Correlations between TCP / 80, TCP / 443, and UDP / 53 can be observed. If a host is opening the QUIC (Quick UDP Internet Connection) protocol (UDP / 443) service, the host is more likely to open HTTPS and HTTP services. It has a 97.90% chance of opening the HTTPS (TCP / 443) service, and also a 90.21% chance of responding to the HTTP (TCP / 80) service.

[0126] TCP / 443 and TCP / 80 also have a strong correlation. Fig.10 Their relative response rate is about 93.09%, indicating that most servers that support HTTP also support HTTPS. Compared with TCP / 443 and TCP / 80, the response rate of UDP / 443 is almost zero in cases where the host responds to other protocols, indicating that the QUIC protocol is not well supported in most servers.

[0127] The existence of alias addresses in IPv6 address prediction will affect the efficiency of the algorithm, which will cause "bias" in the addresses generated by the algorithm. Multiple addresses resolved by the algorithm may point to the same interface, which will cause a waste of detection resources in the process of detecting active addresses. The alias prefix list published by Gasser et al. is used to screen out aliases, and the number of aliases in the candidate sets generated by seed sets C1, C2, and C3 is counted. The statistics of the alias ratio of candidate addresses are shown in Table 5.

[0128] Table 5 Candidate address alias ratio

[0129]

[0130] The alias ratio of the target addresses generated by 6DoubleTree is less than 1%. Therefore, in actual scanning, the alias address has little impact on 6DoubleTree. At the same time, Gasser et al. also screened out alias addresses when constructing the IPv6 seed source. The probability of obtaining an alias address through seed address prediction is low.

[0131] The above experimental results show that the solution has an average improvement of 54.92% in the number of active addresses discovered, and an average improvement of 60.25% in the number of active / 64 prefixes discovered, which has a good application prospect in the field of network asset discovery and management.

[0132] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0133] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0134] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0135] Those skilled in the art will appreciate that all or part of the steps in the above method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk or an optical disk. Optionally, all or part of the steps in the above embodiment can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or in the form of software function modules. The present invention is not limited to any specific form of combination of hardware and software.

[0136] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A dual-space tree-based IPv6 address prediction method, characterized in that: Include: Get the target area IPv6 address seed set; According to the open source Border Gateway Protocol BGP prefix list, the address seed set is divided into seed address subsets of different BGP prefix spaces, and a dual address space tree is generated based on the seed address subset of each BGP prefix space, wherein the dual address space tree includes a prefix space tree generated based on the prefix part of the seed address in the seed address subset and a suffix space tree generated based on the suffix part of the seed address in the seed address subset; Extract leaf nodes from both the prefix space tree and the suffix space tree and concatenate the leaf nodes of the two to generate a candidate address pattern; The BGP prefixes are arranged in descending order according to the number of seed addresses in the BGP prefix space and the address generation priority is set, so that addresses are generated in the corresponding BGP prefix space according to the address generation priority order, and the candidate address set in the corresponding BGP prefix space is obtained by deleting the address alias.

2. The IPv6 address prediction method based on dual space tree according to claim 1, characterized in that: Generate a dual address space tree based on the seed address subset of each BPG prefix space, including: Divide the seed addresses in the seed address subset into a prefix part and a suffix part, and form a prefix part list and a suffix part list; For the prefix partial list and the suffix partial list, the minimum entropy partitioning strategy is used to perform regional division to construct the corresponding prefix space tree and suffix space tree. The minimum entropy partitioning strategy is to perform regional division by finding the dimension with the smallest entropy value each time the space is divided, wherein the entropy value is used to measure the value distribution of the address in different dimensions.

3. The IPv6 address prediction method based on dual space tree according to claim 2, characterized in that: The minimum entropy segmentation strategy is used for region division, including: The prefix partial list and the suffix partial list use the divisive hierarchical clustering algorithm DHC to determine the location of the split indicator and divide the space. The split indicator is determined by the minimum entropy strategy; The divisive hierarchical clustering algorithm DHC is used to iteratively divide the child nodes until the number of address vectors corresponding to the node is less than the threshold or the node dimension is the specified value, and the nodes that are not further divided are regarded as leaf nodes.

4. The IPv6 address prediction method based on dual space trees according to claim 1, characterized in that: Extract the leaf nodes from both the prefix space tree and the suffix space tree and concatenate the leaf nodes of the two, including: Extract leaf nodes in the suffix space tree, mine the interface identifier IID address pattern and count the frequency value, where the frequency value is used to represent the number of seed addresses belonging to the current IID address pattern; Based on the DHC IID address pattern and the frequency IID pattern, a candidate IID address pattern is formed through a pattern refinement strategy; Arrange the frequency values ​​of the candidate IID address pattern list in descending order, delete the IID patterns whose frequency values ​​are lower than the specified threshold, and select the top 5 IID patterns in the candidate IID address patterns as high-density IID patterns; Extract leaf nodes in the prefix space tree to mine prefix address patterns; The high-density IID pattern and the prefix address pattern are traversally combined and spliced ​​to obtain the candidate address pattern.

5. The IPv6 address prediction method based on dual space trees according to claim 4, characterized in that: Mining address patterns, including: For the seed address contained in the tree child node of the address space tree, if the seed address dimension value is not unique, a wildcard is used to represent the variable dimension of the address mode, and the number of wildcards is used to represent the current address mode variable dimension value.

6. The IPv6 address prediction method based on dual space tree according to claim 4 or 5, characterized in that: Statistical frequency values, including: For the mined address pattern, the address pattern with a variable dimension of zero is used as the IID frequency pattern, so as to use the IID frequency pattern to count the IID frequency pattern frequency value, wherein the variable dimension is used to indicate that the dimension in the address vector has different values.

7. The IPv6 address prediction method based on dual space trees according to claim 1, characterized in that: Obtain the candidate address set in the corresponding BGP prefix space by deleting the address alias, including: Obtain an open source alias prefix list, wherein the alias prefix list stores network prefixes of multiple alias addresses pointing to the same interface; The alias prefix list is used to filter and delete the generated addresses to obtain a final set of candidate target addresses.

8. An IPv6 address prediction system based on dual space trees, characterized in that: It includes: seed address collection module, dual space tree construction module, address pattern generation module and target address output module, among which, A seed address collection module is used to obtain a target area IPv6 address seed set; A dual-space tree construction module is used to divide the address seed set into seed address subsets of different BGP prefix spaces according to the open source Border Gateway Protocol BGP prefix list, and generate a dual-address space tree based on the seed address subset of each BPG prefix space, wherein the dual-address space tree includes a prefix space tree generated based on the prefix part of the seed address and a suffix space tree generated based on the suffix part of the seed address; An address pattern generation module, used for extracting leaf nodes from both the prefix space tree and the suffix space tree and concatenating the leaf nodes of the two to generate a candidate address pattern; The target address output module is used to arrange the BGP prefixes in descending order according to the number of seed addresses in the BGP prefix space and set the address generation priority, so as to generate addresses in the corresponding BGP prefix space according to the address generation priority order, and obtain the candidate address set in the corresponding BGP prefix space by deleting the address alias.

9. An electronic device, characterized in that: include: at least one processor, and a memory coupled to the at least one processor; The memory stores a computer program, and the computer program can be executed by the at least one processor to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed, the method according to any one of claims 1 to 7 can be implemented.

Images