IPv6 address prediction method and system based on dual space tree

Abstract

The present invention relates to the field of network space security technology, and in particular to an IPv6 address prediction method and system based on a dual-space tree. The method divides an address seed set into seed address subsets of different BGP prefix spaces according to an open-source Border Gateway Protocol (BGP) prefix list, generates a dual-address space tree based on the seed address subset of each BGP prefix space, extracts leaf nodes from both the prefix space tree and the suffix space tree, and concatenates the leaf nodes to generate a candidate address pattern. The method arranges the BGP prefixes in descending order according to the number of seed addresses in the BGP prefix space and sets an address generation priority, so that addresses are generated in the corresponding BGP prefix space according to the address generation priority order, and obtains a candidate address set in the corresponding BGP prefix space by deleting address aliases. The method can more efficiently discover active addresses and more / 64 active address prefixes, avoid scanning a large number of potentially inactive addresses in the BGP prefix space, and improve the efficiency of the IPv6 address prediction process.

Description

Technical Field

[0001] The present invention relates to the field of network space security technology, and in particular to an IPv6 address prediction method and system based on a dual space tree. Background Art

[0002] Active address scanning is a prerequisite for internet-scale network surveys and measurements. It's part of network security assessments, helping detect potential vulnerabilities and threats, understand threat actor behavior, and ensure secure network operation. The degree of change in host-assigned IP addresses is affected by time. Active address scanning tracks changes in the address space over time, allowing for dynamic analysis of the address space and exploring the characteristics of IPv6 address allocation. Active address scanning also supports network topology detection, which is critical for building an accurate network topology map. Understanding the connections between devices in the network and understanding the network structure are fundamental to effective network management and maintenance. Active address scanning analyzes the geographic distribution of devices based on a database of IP address segments and geolocation, providing insights into the regional distribution of network devices. This helps implement geolocation restrictions and regional access controls, enhancing network security. Overall, internet-scale active address scanning is crucial for network asset management, IP address analysis, geolocation, and network topology discovery.

[0003] In traditional IPv4 internet scanning, high-speed asynchronous scanning tools like ZMap and Masscan are effective for internet-wide IPv4 address scans. ZMap can traverse the entire IPv4 address space in under 45 minutes. Network device search engines like Shodan and Censys can retrieve internet-wide asset data. Internet-wide IPv4 address scans are widespread, while internet-wide IPv6 address scans are less common. This is because these tools struggle to meet the demands of the vast IPv6 address space. Even using ZMap's highest configuration, a scan would take millions of years.

[0004] To address this, researchers have proposed an IPv6 address prediction technology. By learning the statistical and structural information of live or previously live IPv6 seed addresses, this technology predicts and generates IPv6 target addresses that are more likely to be active. This technology can significantly improve the efficiency of scanning for active IPv6 addresses. Current IPv6 address prediction algorithms suffer from the following issues: 1. Low hit rate: An IPv6 address consists of two parts, a prefix and suffix, which are logically independent and functionally distinct. However, when mining structural information, existing IPv6 address prediction algorithms often treat the entire 128-bit IPv6 address as a single entity, ignoring its inherent logical structure, resulting in a relatively low hit rate. 2. Limited sub-prefix space coverage: Existing algorithms often predict an uneven distribution of IPv6 addresses, ignoring the larger potential sub-prefix space within the seed prefix. This limitation limits prediction results to a small number of / 64 sub-prefixes, failing to cover the broader IPv6 address space. 3. Metric limitations: Most current algorithms focus their evaluation on the hit rate of active IPv6 addresses, ignoring the unique structural characteristics of IPv6 addresses. For example, the / 64 prefix typically allocated to individual end sites is not taken into account as an important measurement dimension, which limits the accuracy of the algorithm in assessing the breadth of IPv6 address distribution. Summary of the Invention

[0005] To this end, the present invention provides an IPv6 address prediction method and system based on a dual-space tree, which solves the problems of low hit rate and insufficient sub-prefix coverage in existing IPv6 address prediction technologies.

[0006] According to the design scheme provided by the present invention, on the one hand, a dual-space tree-based IPv6 address prediction method is provided, comprising:

[0007] Get the target area IPv6 address seed set;

[0008] Divide the address seed set into seed address subsets of different BGP prefix spaces according to the open-source Border Gateway Protocol (BGP) prefix list, and generate a dual address space tree based on the seed address subset of each BGP prefix space. The dual address space tree includes a prefix space tree generated based on the prefix part of the seed address and a suffix space tree generated based on the suffix part of the seed address.

[0009] Extracting leaf nodes from both the prefix space tree and the suffix space tree and concatenating the leaf nodes to generate a candidate address pattern;

[0010] Arrange the BGP prefixes in descending order according to the number of seed addresses in the BGP prefix space and set the address generation priority, so as to generate addresses in the corresponding BGP prefix space according to the address generation priority order, and obtain the candidate address set in the corresponding BGP prefix space by deleting the address alias.

[0011] As the IPv6 address prediction method based on the dual space tree of the present invention, further, a dual address space tree is generated with a seed address subset of each BPG prefix space as a unit, including:

[0012] Divide the seed addresses in the seed address subset into a prefix part and a suffix part, and form a prefix part list and a suffix part list;

[0013] For the prefix partial list and the suffix partial list, the minimum entropy partitioning strategy is used to perform regional division to construct the corresponding prefix space tree and suffix space tree. The minimum entropy partitioning strategy is to perform regional division by finding the dimension with the smallest entropy value each time the space is divided, where the entropy value is used to measure the value distribution of the address in different dimensions.

[0014] As the IPv6 address prediction method based on the dual space tree of the present invention, further, the minimum entropy segmentation strategy is used to perform region division, including:

[0015] The prefix partial list and the suffix partial list are used to determine the location of the split indicator and divide the space using the divisive hierarchical clustering algorithm DHC. The split indicator is determined by the minimum entropy strategy.

[0016] The divisive hierarchical clustering algorithm DHC is used to iteratively divide the child nodes until the number of address vectors corresponding to the node is less than the threshold or the node dimension is the specified value, and the nodes that are not further divided are regarded as leaf nodes.

[0017] As the IPv6 address prediction method based on the dual space tree of the present invention, further, extracting leaf nodes from both the prefix space tree and the suffix space tree and splicing the leaf nodes of the two includes:

[0018] Extract the leaf nodes in the suffix space tree, mine the interface identifier IID address pattern and count the frequency value, where the frequency value is used to represent the number of seed addresses belonging to the current IID address pattern;

[0019] Based on the DHC IID address pattern and the frequency IID pattern, a pattern refinement strategy is used to form a candidate IID address pattern;

[0020] Arrange the candidate IID address pattern list in descending order of frequency values, delete IID patterns with frequency values ​​lower than a specified threshold, and select the top K IID patterns in the candidate IID address pattern list as high-density IID patterns;

[0021] Extract leaf nodes in the prefix space tree to mine prefix address patterns;

[0022] The high-density IID pattern and the prefix address pattern are traversally combined and spliced ​​to obtain the candidate address pattern.

[0023] As the IPv6 address prediction method based on the dual space tree of the present invention, further mining the address pattern includes:

[0024] For the seed address contained in the tree child node of the address space tree, if the seed address dimension value is not unique, a wildcard is used to represent the address pattern variable dimension, and the number of wildcards is used to represent the current address pattern variable dimension value.

[0025] As the IPv6 address prediction method based on the dual space tree of the present invention, further, counting frequency values ​​includes:

[0026] For the mined address pattern, the address pattern with a variable dimension of zero is used as the IID frequency pattern, so as to use the IID frequency pattern to count the IID frequency pattern frequency value, where the variable dimension is used to indicate that the dimension in the address vector has different values.

[0027] As the IPv6 address prediction method based on the dual space tree of the present invention, further, obtaining a set of candidate addresses in the corresponding BGP prefix space by deleting address aliases includes:

[0028] Obtain an open source alias prefix list, wherein the alias prefix list stores network prefixes of multiple alias addresses pointing to the same interface;

[0029] The alias prefix list is used to filter and delete the generated addresses to obtain the final set of candidate target addresses.

[0030] On the other hand, the present invention also provides an IPv6 address prediction system based on a dual-space tree, comprising: a seed address collection module, a dual-space tree construction module, an address pattern generation module and a target address output module, wherein:

[0031] A seed address collection module is used to obtain the target area IPv6 address seed set;

[0032] A dual-space tree construction module is used to divide the address seed set into seed address subsets of different BGP prefix spaces according to the open source Border Gateway Protocol (BGP) prefix list, and generate a dual-address space tree based on the seed address subset of each BGP prefix space. The dual-address space tree includes a prefix space tree generated based on the prefix part of the seed address in the seed address subset and a suffix space tree generated based on the suffix part of the seed address in the seed address subset.

[0033] An address pattern generation module is used to extract leaf nodes from both the prefix space tree and the suffix space tree and concatenate the leaf nodes to generate a candidate address pattern;

[0034] The target address output module is used to sort the BGP prefixes in descending order according to the number of seed addresses in the BGP prefix space and set the address generation priority, so as to generate addresses in the corresponding BGP prefix space according to the address generation priority order, and obtain the candidate address set in the corresponding BGP prefix space by deleting the address alias.

[0035] Beneficial effects of the present invention:

[0036] This invention divides IPv6 addresses into two parts: the prefix (the first 64 bits) and the suffix (the last 64 bits). It then mines and refines address patterns using the Border Gateway Protocol (BGP) prefix space as a unit. This allows for fine-grained and extensive address prediction in the seed prefix space, more efficiently discovering active addresses and more / 64 active address prefixes. This effectively avoids scanning a large number of potentially inactive addresses in the BGP prefix space, and improves the efficiency of the IPv6 address prediction process. Experimental results further demonstrate that, under limited budget conditions, this solution achieves a hit rate of 47.05% to 63.53%. Compared to seven existing algorithms, including 6Forest and 6Graph, this solution achieves an average improvement of 54.92% in the number of active addresses discovered and 60.25% in the number of active / 64 prefixes discovered. This approach has promising application prospects in areas such as cyberspace assets and security. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 Schematic diagram of the IPv6 address prediction process based on the dual space tree in the embodiment;

[0038] Figure 2 Schematic diagram of the architecture of the IPv6 address prediction tool DoubleTree based on dual space tree in the embodiment;

[0039] Figure 3 This is a schematic diagram of constructing a space tree for the suffix part in the embodiment;

[0040] Figure 4 This is a schematic diagram of the refinement of the IID model in the embodiment;

[0041] Figure 5 This is a schematic diagram of the splicing of prefix and suffix address patterns in the embodiment;

[0042] Figure 6 This is a diagram illustrating the distribution of BGP prefixes of the seed address set in the embodiment;

[0043] Figure 7Schematic diagram of the analysis of the correlation response of the seed set to common upper layer protocols in the embodiment;

[0044] Figure 8 This is a schematic diagram of the number of prefix patterns generated by different seed set segmentation strategies in the embodiment;

[0045] Figure 9 This is a comparison of the hit rates of active addresses on the seed set in the embodiment;

[0046] Figure 10 This is a schematic diagram of the analysis of the correlation response of candidate addresses to common protocols in the embodiment. DETAILED DESCRIPTION

[0047] In order to make the objectives, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below with reference to the accompanying drawings and technical solutions.

[0048] Before introducing the solution for this case, the following explanations are given for the relevant terms involved in the solution:

[0049] IPv6 address vector: A 128-bit binary IPv6 address a is converted into a 32-bit hexadecimal IPv6 address vector x. Each bit of vector x has a value in the range [0, f].

[0050] Variable dimensions and fixed dimensions: When a dimension has different values, use the wildcard * to indicate a variable dimension. If the dimension value is any value in the hexadecimal range [0, f], the dimension is a fixed dimension.

[0051] Address pattern mining: For the seed addresses contained in the leaf nodes of the address space tree, when the value of a dimension is not a unique value, the dimension is a variable dimension, represented by *, and the number of wildcard characters * represents the variable dimension value v of the pattern.

[0052] Detecting address space: When generating an address space tree for pattern mining, an address pattern is formed. The magnitude of the address space to be detected is 16 v An address pattern like this: 20010558fe320***000000000000000* can generate 16 4 IPv6 target addresses are available for detection.

[0053] Frequency value: In the pattern mining phase, the IID pattern list is formed by using dynamic host configuration (DHC) and address frequency. The frequency value is defined as the number of seed addresses in the pattern.

[0054] Address region density: For a seed region or address pattern P and seed set S with variable dimension μ, the corresponding density is P.density = S.size() / μ

[0055] Entropy value: The IPv6 address vector consists of 32 hexadecimal bits, and the entropy value of the kth bit is H(X j ) is calculated as:

[0056] Indicates that the value of the kth half byte of the address is The value set Q of is {0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f}, 16 possible values, P(X k ) indicates the value is X k The probability that H(X j )=0, it means that the value of the kth half byte of the seed address is unique. j )=1, it means that the seed address takes all values ​​in the set Q in the kth half byte, and the probability is the same.

[0057] Active address hit rate: The hit rate can be defined as the ratio of active addresses generated by the algorithm to the total number of candidate addresses generated. The calculation formula is R hit =N active / N candidate .

[0058] The discovery and management of network assets are crucial to network security. Existing IPv6 address prediction technologies have problems such as low hit rate and insufficient sub-prefix coverage. To this end, an embodiment of the present invention provides an IPv6 address prediction method based on a dual space tree, such as Figure 1 As shown, including:

[0059] S101, obtaining a target area IPv6 address seed set;

[0060] S102. Divide the address seed set into seed address subsets of different BGP prefix spaces according to an open-source Border Gateway Protocol (BGP) prefix list, and generate a dual address space tree based on the seed address subset of each BGP prefix space. The dual address space tree includes a prefix space tree generated based on the prefix portion of the seed address in the seed address subset and a suffix space tree generated based on the suffix portion of the seed address in the seed address subset.

[0061] S103, extracting leaf nodes from both the prefix space tree and the suffix space tree and concatenating the leaf nodes to generate a candidate address pattern;

[0062] S104. Arrange the BGP prefixes in descending order according to the number of seed addresses in the BGP prefix space and set an address generation priority, so as to generate addresses in the corresponding BGP prefix space according to the address generation priority order, and obtain a set of candidate addresses in the corresponding BGP prefix space by deleting the address alias.

[0063] By analyzing the IPv6 address prefix structure and suffix part (i.e., interface identifier IID part) allocation strategy in the BGP prefix space, and predicting and generating IPv6 active target addresses based on the dual-space tree structure, more / 64 sub-prefix spaces can be explored and active addresses can be discovered efficiently.

[0064] The address prediction tool 6DoubleTree architecture built based on this case solution is as follows Figure 2 As shown, a public BGP prefix list is used to divide the seed address set into different BGP prefix areas. In the BGP prefix space, the last 64 bits of the IID of active IPv6 addresses are more consistent with certain patterns, resulting in a high-density IID pattern in the BGP prefix space. 6DoubleTree combines the address patterns formed by the leaf nodes of the address space tree, that is, the prefix pattern and the high-density IID pattern are spliced ​​together to form a candidate address pattern for subsequent IPv6 address generation. High-density seed areas are more likely to discover active addresses, and the proportion of seed addresses in the BGP prefix space to a certain extent reflects the density distribution of active IPv6 addresses in real network environments. During the IPv6 address generation process, 6DoubleTree sorts the BGP prefix areas in descending order of seed address density and prioritizes address generation in high-density BGP prefix areas to avoid wasting detection resources.

[0065] The dual address space tree is generated based on the seed address subset of each BPG prefix space and can be designed to include:

[0066] Divide the seed addresses in the seed address subset into a prefix part and a suffix part, and form a prefix part list and a suffix part list;

[0067] For the prefix partial list and the suffix partial list, the minimum entropy partitioning strategy is used to perform regional division to construct the corresponding prefix space tree and suffix space tree. The minimum entropy partitioning strategy is to perform regional division by finding the dimension with the smallest entropy value each time the space is divided, where the entropy value is used to measure the value distribution of the address in different dimensions.

[0068] Based on the different purposes of the prefix and suffix parts, in this embodiment, consideration is given to how to divide the two parts into regions to construct a spatial tree.

[0069] In the prefix part, 6DoubleTree aims to mine as many prefix patterns as possible in the seed prefix and explore a wider sub-prefix space of the seed prefix space. The minimum entropy partitioning strategy has the greatest advantage in terms of the number of prefix patterns. In the prefix part, the minimum entropy partitioning strategy is selected for region partitioning to construct the spatial tree.

[0070] In the suffix part, the purpose of 6DoubleTree is to mine high-density IID patterns and obtain high-density IID patterns in the BGP prefix space to ensure that the target address is as active as possible. Among the existing algorithms' spatial tree partitioning strategies, the minimum entropy partitioning strategy can avoid partitioning high-density areas and ensure that high-density areas are located in the leaf nodes or the same branch of the spatial tree. In the suffix part, the minimum entropy partitioning strategy is also selected for area partitioning to construct the spatial tree. The spatial tree construction example is as follows: Figure 3 As shown, the construction principle of the prefix part space tree is the same as that in the example.

[0071] The dual-space tree construction algorithm is shown in Algorithm 1:

[0072]

[0073] Algorithm 1 describes the basic logic for constructing a dual-space tree. The seed address set is vectorized and the root node root is initialized, representing the entire seed address set. The seed address set is partitioned into two lists: a 0-15-bit prefix and a 16-32-bit suffix. Distributed High-Channel (DHC) is performed on each of these lists. The split indicator, split_index, is determined using a minimum entropy method. DHC is iteratively performed on child nodes until the number of address vectors corresponding to a node falls below a threshold δ or the node dimension reaches 1. Nodes that are not further partitioned are called leaf nodes and store high-density address patterns.

[0074] Among them, extracting leaf nodes from both the prefix space tree and the suffix space tree and concatenating the leaf nodes of the two can be designed to include:

[0075] Extract the leaf nodes in the suffix space tree, mine the interface identifier IID address pattern and count the frequency value, where the frequency value is used to represent the number of seed addresses belonging to the current IID address pattern;

[0076] Form a candidate IID address pattern based on the IID address pattern and the IID frequency pattern of the DHC;

[0077] Arrange the candidate IID address pattern list in descending order of frequency values, delete IID patterns with frequency values ​​lower than a specified threshold, and select the top K IID patterns in the candidate IID address pattern list as high-density IID patterns;

[0078] Extract leaf nodes in the prefix space tree to mine prefix address patterns;

[0079] The high-density IID pattern and the prefix address pattern are traversally combined and spliced ​​to obtain the candidate address pattern.

[0080] For the seed address contained in the tree child node of the address space tree, if the seed address dimension value is not unique, a wildcard can be used to represent the seed address dimension, and the number of wildcards can be used to represent the variable dimension value of the current address mode.

[0081] For the mined address pattern, the address pattern with a variable dimension of zero is used as the IID frequency pattern, so as to use the IID frequency pattern to count the IID frequency pattern frequency value, where the variable dimension is used to indicate that the dimension in the address vector has different values.

[0082] like Figure 2 As shown, 6DoubleTree adopts certain rules to refine the suffix (IID) pattern. Specifically, 6DoubleTree performs frequency statistics on the regional seed addresses, counts the frequency values ​​of the IID frequency pattern (that is, the address pattern with a variable dimension of zero) and arranges them in descending order. 6DoubleTree extracts the leaf nodes of the suffix part of the spatial tree, mines the DHC-IID pattern (that is, the IID address pattern formed by DHC) and counts the frequency value, and takes the union of the mined DHC-IID pattern and the IID frequency pattern to form a candidate IID address pattern. The frequency value represents the number of seed addresses belonging to the pattern.

[0083] A specific example of IID model refinement is as follows: Figure 4 As shown in the figure, the frequency value of the DHC-IID pattern "00ff:00ff:00ff:00f*" is 64. In the IID frequency pattern list, the frequency values ​​of "00ff:00ff:00ff:00ff" and "00ff:00ff:00ff:00fe" are 34 and 25, which almost cover all the seed addresses of the "00ff:00ff:00ff:00f*" pattern. However, IID frequency patterns that appear very rarely are included in the DHC-IID pattern, such as "00ff:00ff:00ff:00fa" with a frequency value of 5, which increases the dimension of the DHC-IID address pattern and expands the address scanning space.

[0084] To obtain high-density IID patterns in the BGP prefix space, 6DoubleTree sorts the candidate IID address pattern list in descending order of frequency and deletes IID patterns with frequency values ​​below 10. Such patterns do not significantly represent the logical rules for allocating IPv6 address IIDs in the BGP prefix space. Finally, 6DoubleTree selects the top 5 high-density IID patterns with the highest frequency values ​​from the candidate IID address patterns for subsequent combination and concatenation with the prefix pattern. 6DoubleTree effectively reduces the dimensionality of IID patterns, reducing unnecessary scanning space and improving scanning efficiency. Algorithm 2 describes the basic logic for constructing candidate address patterns:

[0085]

[0086] 6DoubleTree extracts the address patterns of the leaf nodes of the prefix and suffix parts, and performs a pattern refinement strategy on the suffix pattern to obtain the IID pattern, where the two variables suffixes and iid_fre_pattern represent the DHC-IID pattern and the IID frequency pattern respectively. During the splicing process, 6DoubleTree traverses and combines the top 5 IID patterns with the prefix pattern to obtain a complete candidate address pattern, which is used to generate the target address. The example of splicing the prefix and suffix address pattern is as follows: Figure 5 shown.

[0087] 6DoubleTree focuses on IPv6 address prediction by focusing on the IID allocation patterns and the number of prefix patterns in the BGP prefix space. It avoids designing complex target address generation strategies. IPv6 addresses are more likely to be active in denser BGP prefix spaces. Therefore, 6Double generates IPv6 addresses based on BGP prefix space density and eliminates alias addresses from target addresses to avoid scanning alias addresses.

[0088] 6DoubleTree sorts BGP prefixes by the number of seed addresses in the BGP prefix space. It then generates a double-space tree and builds a candidate address model based on the seed address set of each BGP prefix space. It prioritizes budget allocation for target address generation in high-density BGP prefix spaces, ensuring that the generated target addresses match the address space density distribution. Finally, it removes aliases from the target addresses to obtain a set of candidate addresses.

[0089] The candidate address set in the corresponding BGP prefix space is obtained by deleting the address alias, which may include:

[0090] Obtain an open source alias prefix list, wherein the alias prefix list stores multiple alias addresses pointing to the same interface;

[0091] The alias prefix list is used to filter and delete the generated addresses to obtain the final set of candidate target addresses.

[0092] Furthermore, based on the above method, an embodiment of the present invention also provides an IPv6 address prediction system based on a dual-space tree, comprising: a seed address collection module, a dual-space tree construction module, an address pattern generation module and a target address output module, wherein:

[0093] A seed address collection module is used to obtain the target area IPv6 address seed set;

[0094] A dual-space tree construction module is used to divide the address seed set into seed address subsets of different BGP prefix spaces according to the open source Border Gateway Protocol (BGP) prefix list, and generate a dual-address space tree based on the seed address subset of each BGP prefix space. The dual-address space tree includes a prefix space tree generated based on the prefix part of the seed address in the seed address subset and a suffix space tree generated based on the suffix part of the seed address in the seed address subset.

[0095] An address pattern generation module is used to extract leaf nodes from both the prefix space tree and the suffix space tree and concatenate the leaf nodes to generate a candidate address pattern;

[0096] The target address output module is used to sort the BGP prefixes in descending order according to the number of seed addresses in the BGP prefix space and set the address generation priority, so as to generate addresses in the corresponding BGP prefix space according to the address generation priority order, and obtain the candidate address set in the corresponding BGP prefix space by deleting the address alias.

[0097] To verify the effectiveness of this solution, the following is a further explanation based on experimental data:

[0098] Gasser et al. collected active IPv6 addresses from various sources, including servers, routers, and clients, to construct a public IPv6 hitlist data source. This work made the IPv6 hitlist service publicly available in 2018, and Zirngibl et al. have since updated and improved the service. The experiment collected non-alias address data as of March 16, 2024, containing 18,488,319 globally active IPv6 addresses, as address set C0. Using the Pyasn database, statistics revealed that the data covered 71,154 BGP prefixes and 21,392 ASes. Table 1 shows the address data sources.

[0099] Table 1 IPv6 address data source

[0100]

[0101] Using downsampling allows us to construct a dataset that more closely matches the distribution of hitlist addresses. A balanced seed dataset more realistically reflects the density distribution of IPv6 addresses in the prefix space, generating more potentially active IPv6 addresses in a region based on spatial density and seed address structure. Therefore, 25k, 50k, and 0.1M addresses were randomly sampled from C0 to form balanced IPv6 address seed sets C1, C2, and C3 to support subsequent experimental measurements. Seed set information is shown in Table 2.

[0102] Table 2 IPv6 seed address set information

[0103]

[0104] Experimental Environment: An internet-wide scanning experiment was conducted in July 2024, limiting the probe rate to 30 Mbps to minimize network impact on internet users. The scanner, using ICMPv6 probes, was deployed on an Ubuntu 22.04 platform with a quad-core 2.60 GHz Intel Core processor, 8 GB of RAM, and a 500 Mbps network interface card.

[0105] Pyasn is a Python extension module developed by Dr. Hadi Asghari and Dr. Arman Noroozian of Delft University of Technology during their work on network security measurements. It enables efficient lookup of IP addresses to Autonomous System Numbers (AS). This experiment uses the Pyasn module to retrieve the Pyasn database, which contains 209,580 IPv6 BGP-routable prefixes as of March 20, 2024.

[0106] Figure 6 The prefix distribution of the IPv6 Hitlist, C1, C2, and C3 seed sets is shown, with the horizontal axis representing the number of BGP prefixes and the vertical axis representing the proportion of seed addresses in the current prefix to the total number of seeds. The top 10 BGP prefixes account for nearly 30% of the total number of seeds (point A), the top 100 BGP prefixes account for over 60% of the total number of seed addresses (point B), and the top 1,000 BGP prefixes account for over 85% of the total number of seed addresses (point C). It can be seen that the distribution of the IPv6 seed address set across these prefixes is extremely uneven, with the seed address sets concentrated in areas with a high density of BGP prefixes. Furthermore, the density distribution of the seed sets C1, C2, and C3 selected for the experiment is similar to that of the IPv6 Hitlist, and the dataset density also meets the purpose of 6DoubleTree's target address generation based on the BGP prefix space.

[0107] Figure 7 The data shows the responses of the C0 seed set addresses to common protocols, including ICMPv6, TCP / 21, TCP / 22, TCP / 23, TCP / 80, TCP / 110, TCP / 443, TCP / 8080, UDP / 53, and UDP / 443. As shown in the heat map, the numbers represent the probability of responding to protocol Y under the condition of responding to protocol X. Among them, it can be seen from the first row of data that if the host responds to any other protocol, at least 86.96% of IPv6 addresses respond to ICMPv6. Therefore, ICMPv6 is an important means of verifying the activeness of IPv6 active addresses. In order to reduce network resource consumption during the experimental measurement, only ICMPv6 echo requests (Echo Request) were sent throughout the experiment to detect whether the target address is in an active state.

[0108] Most address prediction algorithms use the leftmost splitting strategy to construct spatial trees, such as 6Tree and 6Scan. When clustering regions, they look for the first dimension in the address list that has different values ​​from the left as the split indicator position for splitting.

[0109] The DET algorithm proposes a minimum entropy partitioning strategy. Each time a spatial partition is performed, it seeks the dimension with the lowest entropy value for partitioning. This minimizes the partitioning of high-density areas and ensures that high-density areas are located on leaf nodes or the same branch of the spatial tree. Minimum density loss is achieved by partitioning the current seed set along the dimension with the lowest entropy value.

[0110] 6Forest proposes a new metric to prioritize partitioning dimensions: the covering number, which represents the number of non-unique nibbles across all seeds along a given dimension. The partition indicator selects the dimension with the largest covering number as the partitioning dimension for that subspace. This is known as the maximum covering partitioning strategy. Seeds with identical nibbles along this dimension are grouped together, minimizing the impact on outliers.

[0111] Different spatial tree partitioning strategies affect the density of the address space region, but also result in different numbers of address patterns mined by the constructed spatial tree. We compared the number of prefix address patterns mined by running the prefix minimum entropy partitioning strategy, the prefix leftmost partitioning strategy, and the prefix maximum coverage strategy on the three seed address sets C1, C2, and C3.

[0112] The pattern dimension is closely related to the quality of the generated target address and the data size. In the process of pattern mining, when the dimension increases, the address space covered and the number of generated addresses will increase exponentially, which increases the uncertainty and low activity of the address. Therefore, the variable dimension is controlled below 5. Under the condition of dimension ≤ 4, such as Figure 8 As shown, min, left, and max represent the minimum entropy, leftmost, and maximum coverage segmentation strategies respectively. The total number of prefix patterns obtained by the minimum entropy strategy on different seed sets is 8.92%-13.18% more than that of the leftmost strategy, and 4.91%-13.10% more than that of the maximum coverage strategy.

[0113] Explore the number of patterns generated in the prefix part under different segmentation strategies. Mining more prefix patterns means that more address space in the prefix area can be explored. Therefore, the minimum entropy segmentation strategy can be selected in the prefix part.

[0114] We explored the performance comparison of 6DoubleTree with current mainstream algorithms. We ran and evaluated the nine algorithms listed in Table 3 for comparison. Entropy / IP is not suitable for inputs larger than 0.1M addresses, but the experimental seed dataset size is suitable. Since the publicly available source code for 6Graph and 6Forest does not include target address generation, we used a Hamming distance-based target address generation method to construct candidate sets for 6Graph and 6Forest for subsequent experiments.

[0115] In the 6GCVAE algorithm experiment, the source code parameters are kept unchanged and the seed address vector is input for model training. The algorithm generation address budget is adjusted by setting "generation_number".

[0116] The experiment used the C1, C2, and C3 seed sets as algorithm input, respectively, and set the budget to 200 times the input seed size, namely 5M, 10M, and 20M. Based on the budget, a candidate address set was successfully generated. Data cleaning steps, such as deduplication and alias removal, were also performed. The candidate address set served as input to the ZMapv6 asynchronous scanning tool, which used the ICMPv6 protocol to detect active addresses. The prefixes of the active addresses were extracted and deduplicated to obtain the number of active / 64 prefixes. Table 3 compares the number of active addresses generated by 6DoubleTree and a typical algorithm under the same budget.

[0117] Table 3 Comparison of the number of active addresses with typical IPv6 address prediction algorithms

[0118]

[0119] Comparison of active address hit rates Figure 9 As shown in the figure, deep learning-based IPv6 address prediction algorithms such as 6GCVAE are not sufficient for large-scale IPv6 address prediction tasks. The model training phase is time-consuming and results in poor prediction performance. Entropy / IP, a typical address prediction algorithm based on seed statistics, generates targets based on the distribution of address values ​​across different nibbles. However, its high time complexity makes it unsuitable for large-scale address prediction tasks. The 6DoubleTree algorithm primarily predicts IPv6 addresses based on seed address structure information. Therefore, compared to seven other address prediction algorithms based on seed address structure information, 6DoubleTree achieves an average 54.92% improvement in the number of active addresses discovered, compared to seven other algorithms based on seed address structure information, such as 6Forest and 6Graph, under the same budget. Its active address hit rate reaches 47.05% to 63.53%.

[0120] After probing the candidate address set using ICMPv6 to obtain active IPv6 addresses, we extracted the first 64 bits of the active addresses. We then counted and compared the number of active / 64 prefixes obtained by 6DoubleTree and other algorithms on seed sets C1, C2, and C3. Detailed statistics are shown in Table 4.

[0121] Table 4 Comparison of the number of active / 64 prefixes with typical IPv6 address prediction algorithms

[0122]

[0123] 6DoubleTree also outperforms most typical algorithms in terms of the number of active / 64 prefixes, exploring more sub-prefix space within the BGP prefix. Compared to seven algorithms, including 6Forest and 6Graph, 6DoubleTree achieves improvements of 18.97% to 192.05%.

[0124] 6Gen achieved the best results in obtaining the number of active / 64 prefixes in dataset C3, while HMap6 achieved the best results in dataset C1. This is due to the differences between the AHC and DHC clustering methods. 6Gen uses the AHC hierarchical clustering method, while HMap6 generates target addresses by combining address patterns from both DHC and AHC clustering methods. Most of these patterns are derived from AHC clustering. This is due to the bottom-up nature of the AHC clustering method, which allows it to explore more sub-prefix areas within a given generation budget.

[0125] Figure 10 The figure shows the response of the target IPv6 addresses discovered by 6DoubleTree for common protocols when inputting C3 seed set. It is found that there is a strong correlation between the services provided by IPv6 hosts, and the responsiveness of the discovered target addresses is similar to Figure 7 Correlation between TCP / 80, TCP / 443, and UDP / 53 can be observed. If a host is running the QUIC (Quick UDP Internet Connection) protocol (UDP / 443) service, it is more likely to have HTTPS and HTTP services running. It has a 97.90% chance of running HTTPS (TCP / 443) and a 90.21% chance of responding to HTTP (TCP / 80).

[0126] There is also a strong correlation between TCP / 443 and TCP / 80. Figure 10Their relative response rate is about 93.09%, indicating that most servers that support HTTP also support HTTPS. Compared with TCP / 443 and TCP / 80, the response rate of UDP / 443 is almost zero in cases where the host responds to other protocols, indicating that the QUIC protocol is not well supported in most servers.

[0127] Aliases in IPv6 address prediction can affect algorithm efficiency and bias the generated addresses. Multiple addresses resolved by the algorithm may point to the same interface, wasting detection resources during active address detection. Aliases are filtered using the alias prefix list published by Gasser et al. The number of aliases in the candidate sets generated from seed sets C1, C2, and C3 is counted. Table 5 shows the alias ratio of candidate addresses.

[0128] Table 5 Candidate address alias ratio

[0129]

[0130] The alias ratio of the target addresses generated by 6DoubleTree is less than 1%. Therefore, in actual scanning, the alias address has little impact on 6DoubleTree. At the same time, Gasser et al. also screened out alias addresses when constructing the IPv6 seed source. The probability of obtaining an alias address through seed address prediction is low.

[0131] The above experimental results show that this solution has an average improvement of 54.92% in the number of discovered active addresses and 60.25% in the number of discovered active / 64 prefixes, showing good application prospects in the field of network asset discovery and management.

[0132] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0133] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0134] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0135] Those skilled in the art will appreciate that all or part of the steps in the above method can be performed by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a magnetic disk, or an optical disk. Alternatively, all or part of the steps in the above embodiment can be implemented using one or more integrated circuits. Accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or software functional modules. The present invention is not limited to any specific combination of hardware and software.

[0136] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the above-described embodiments, those skilled in the art should understand that any person skilled in the art can modify or easily conceive of changes to the technical solutions described in the above-described embodiments within the technical scope disclosed by the present invention, or replace some of the technical features therein with equivalents. Such modifications, changes, or replacements do not deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be subject to the scope of protection of the claims.

Claims

1. A dual-space tree-based IPv6 address prediction method, characterized in that: Include: Get the target area IPv6 address seed set; Divide the address seed set into seed address subsets of different BGP prefix spaces according to the open-source Border Gateway Protocol (BGP) prefix list, and generate a dual address space tree based on the seed address subset of each BGP prefix space. The dual address space tree includes a prefix space tree generated based on the prefix portion of the seed address in the seed address subset and a suffix space tree generated based on the suffix portion of the seed address in the seed address subset. Extracting leaf nodes from both the prefix space tree and the suffix space tree and concatenating the leaf nodes to generate a candidate address pattern; Arrange the BGP prefixes in descending order according to the number of seed addresses in the BGP prefix space and set the address generation priority, so as to generate addresses in the corresponding BGP prefix space according to the address generation priority order, and obtain the candidate address set in the corresponding BGP prefix space by deleting the address alias.

2. The IPv6 address prediction method based on dual space tree according to claim 1, characterized in that: Generate a dual address space tree based on the seed address subset of each BPG prefix space, including: Divide the seed addresses in the seed address subset into a prefix part and a suffix part, and form a prefix part list and a suffix part list; For the prefix partial list and the suffix partial list, the minimum entropy partitioning strategy is used to perform regional division to construct the corresponding prefix space tree and suffix space tree. The minimum entropy partitioning strategy is to perform regional division by finding the dimension with the smallest entropy value each time the space is divided, where the entropy value is used to measure the value distribution of the address in different dimensions.

3. The IPv6 address prediction method based on dual space tree according to claim 2, characterized in that: The minimum entropy segmentation strategy is used for region division, including: The prefix partial list and the suffix partial list are used to determine the location of the segmentation indicator and divide the space using the divisive hierarchical clustering algorithm DHC. The segmentation indicator is determined by the minimum entropy strategy. The divisive hierarchical clustering algorithm DHC is used to iteratively divide the child nodes until the number of address vectors corresponding to the node is less than the threshold or the node dimension is the specified value, and the nodes that are not further divided are regarded as leaf nodes.

4. The IPv6 address prediction method based on dual space tree according to claim 1, characterized in that: Extract the leaf nodes from both the prefix space tree and the suffix space tree and concatenate the leaf nodes, including: Extract the leaf nodes in the suffix space tree, mine the interface identifier IID address pattern and count the frequency value, where the frequency value is used to represent the number of seed addresses belonging to the current IID address pattern; Based on the DHC IID address pattern and the frequency IID pattern, a pattern refinement strategy is used to form a candidate IID address pattern; Sort the candidate IID address pattern list by frequency values ​​in descending order, delete the IID patterns with frequency values ​​lower than the specified threshold, and select the top 5 IID patterns in the candidate IID address pattern list as high-density IID patterns; Extract leaf nodes in the prefix space tree to mine prefix address patterns; The high-density IID pattern and the prefix address pattern are traversally combined and spliced ​​to obtain the candidate address pattern.

5. The IPv6 address prediction method based on dual space tree according to claim 4, characterized in that: Mining address patterns, including: For the seed address contained in the tree child node of the address space tree, if the seed address dimension value is not unique, a wildcard is used to represent the address pattern variable dimension, and the number of wildcards is used to represent the current address pattern variable dimension value.

6. The IPv6 address prediction method based on dual space tree according to claim 4 or 5, characterized in that: Statistical frequency values, including: For the mined address pattern, the address pattern with a variable dimension of zero is used as the IID frequency pattern, so as to use the IID frequency pattern to count the IID frequency pattern frequency value, where the variable dimension is used to indicate that the dimension in the address vector has different values.

7. The IPv6 address prediction method based on dual space tree according to claim 1, characterized in that: Obtain the candidate address set in the corresponding BGP prefix space by deleting the address alias, including: Obtain an open source alias prefix list, wherein the alias prefix list stores network prefixes of multiple alias addresses pointing to the same interface; The alias prefix list is used to filter and delete the generated addresses to obtain the final set of candidate target addresses.

8. An IPv6 address prediction system based on dual space trees, characterized in that: It includes: seed address collection module, dual space tree construction module, address pattern generation module and target address output module, among which, A seed address collection module is used to obtain the target area IPv6 address seed set; A dual-space tree construction module is used to divide the address seed set into seed address subsets of different BGP prefix spaces according to the open source Border Gateway Protocol (BGP) prefix list, and generate a dual-address space tree based on the seed address subset of each BGP prefix space. The dual-address space tree includes a prefix space tree generated based on the prefix part of the seed address and a suffix space tree generated based on the suffix part of the seed address; An address pattern generation module is used to extract leaf nodes from both the prefix space tree and the suffix space tree and concatenate the leaf nodes to generate a candidate address pattern; The target address output module is used to sort the BGP prefixes in descending order according to the number of seed addresses in the BGP prefix space and set the address generation priority, so as to generate addresses in the corresponding BGP prefix space according to the address generation priority order, and obtain the candidate address set in the corresponding BGP prefix space by deleting the address alias.

9. An electronic device, characterized in that: include: at least one processor, and a memory coupled to the at least one processor; The memory stores a computer program, and the computer program can be executed by the at least one processor to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, and when the computer program is executed, the method according to any one of claims 1 to 7 can be implemented.

Images