IPv6 address detection method and system based on large language model

Abstract

The invention discloses an IPv6 address detection method and system based on a large language model, and relates to the technical field of IPv6 address detection, and the method comprises the steps: obtaining a plurality of active IPv6 addresses as seed addresses, and constructing an IPv6 seed data set; pre-classifying each sub-address, and then constructing a large language model IPv6 fine tuning data set; performing fine tuning on the large language model by utilizing the fine tuning data set and adopting a LoRA method, then adopting a vLLM acceleration reasoning framework, generating a plurality of IPv6 addresses, and constructing an IPv6 address candidate set; and performing multi-dimensional evaluation on the IPv6 address candidate set, extracting active IPv6 addresses in the IPv6 address candidate set, merging the active IPv6 addresses into the original seed data set, and performing continuous circulation to complete IPv6 address detection. According to the invention, effective IPv6 address generation with better effect and higher efficiency can be realized, and multi-dimensional comprehensive automatic evaluation of the generated IPv6 address is realized.

Description

Technical Field

[0001] The present invention relates to the technical field of IPv6 address detection, and in particular to an IPv6 address detection method and system based on a large language model. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] With the rapid development of the Internet, more and more devices can access the Internet. However, the original IPv4 address space is limited to 2 32 , the address space is very limited, and the current IPv4 addresses have been fully allocated, which makes the problem of IPv4 exhaustion more prominent. In order to solve this problem, IPv6 came into being. The IPv6 address space is 2 128 In theory, every grain of sand can get an IPv6 address, which fundamentally solves the problem of IPv4 address exhaustion. However, with the use of IPv6, some problems have become increasingly prominent. One of the most serious problems is the inability to scan the entire IPv6 address space.

[0004] Scanning the entire IPv6 address space, that is, fully mastering the IPv6 address space, is an important basis for network attack and defense, and is an important basis for network attacks such as IPv6 network equipment and service identification and positioning, vulnerability discovery, and penetration testing. Perceiving the IPv6 Internet network topology and key nodes is of great significance to ensuring information network security and seizing information advantages in cyberspace. For IPv4 addresses, using fast scanning tools such as Zmap, the entire IPv4 address space can be traversed within an hour. However, for the IPv6 address space, it takes hundreds of millions of years to scan continuously with the current strongest computing power. In order to solve the problem of being unable to directly traverse and scan the IPv6 address space, current research has proposed a variety of IPv6 address generation methods. The core idea of ​​the IPv6 address generation method is to find the relationship between active IPv6 addresses based on known active IPv6 addresses by analyzing the structure or semantics of IPv6 addresses, so as to find the most densely populated area containing active IPv6 addresses in the entire IPv6 space, generate IPv6 addresses with a high activity rate, and use the predicted generated addresses as scanning targets to achieve the purpose of IPv6 address scanning.

[0005] The current address detection methods can be divided into two categories. The first category is to generate IPv6 addresses based on the structural information of seed addresses. It analyzes the structural information of seed addresses by artificially dividing the address space, searches for address spaces with dense seed distribution, and generates IPv6 addresses. However, most of these methods use the DHC (divisive hierarchical clustering) algorithm. Although it helps to quickly narrow the search range and concentrate resources to detect more likely active address areas, during the execution of the DHC algorithm, it may be too focused on high-density areas, thereby ignoring those areas that may contain active addresses but have lower density. At the same time, the performance and effect of the DHC algorithm may also be highly dependent on the selection and distribution of the initial seed address. If the seed address is unevenly distributed, it may lead to deviations in the scanning results. In some cases, DHC may over-divide the address space, resulting in the generation of too many subspaces, which may make subsequent scanning work complicated and inefficient.

[0006] To this end, a second type of method based on the semantic information of the seed address to generate IPv6 addresses is proposed. It uses artificial intelligence methods to analyze the semantic information of the seed address, explore the distribution pattern of the seed, and thus generate the IPv6 address. However, this method also has certain problems: the current artificial intelligence model has a poor learning ability for the semantic information of the seed address, resulting in poor results in generating IPv6 addresses, and the algorithm's ability to generate addresses in batches still needs to be improved; at the same time, there is currently no quick and effective comprehensive evaluation method for the IPv6 addresses generated by the algorithm, and the effectiveness of the final generated IPv6 addresses cannot be guaranteed. Summary of the invention

[0007] In order to solve the problem that the address generation algorithm is currently inefficient during IPv6 address detection and the generated IPv6 address cannot be quickly and effectively evaluated, the present invention provides an IPv6 address detection method and system based on a large language model, which achieves better and more efficient effective IPv6 address generation by fine-tuning the construction of a large language model data set and fine-tuning the large language model, combined with a vLLM fast reasoning framework, and realizes multi-dimensional and comprehensive automated evaluation of the generated IPv6 addresses.

[0008] In a first aspect, the present invention provides an IPv6 address detection method based on a large language model.

[0009] A method for detecting an IPv6 address based on a large language model, comprising:

[0010] Obtain several active IPv6 addresses as seed addresses and construct an IPv6 seed data set;

[0011] Pre-classify each seed address in the IPv6 seed data set, and construct a large language model IPv6 fine-tuning data set based on the pre-classified seed addresses;

[0012] The constructed IPv6 fine-tuning dataset is used to fine-tune the large language model using the LoRA method;

[0013] Based on the fine-tuned large language model, the vLLM accelerated reasoning framework is used to generate several IPv6 addresses and construct an IPv6 address candidate set.

[0014] Based on the IPv6 address candidate set, a multi-dimensional evaluation is performed on the hit rate, generation rate, diversity, innovation, and proportion of alias addresses, and active IPv6 addresses in the IPv6 address candidate set are extracted;

[0015] The generated active IPv6 addresses are used as seed addresses and merged with the original seed data set to obtain an updated seed data set. This cycle is repeated continuously to complete the detection of the IPv6 address space.

[0016] In a second aspect, the present invention provides an IPv6 address detection system based on a large language model.

[0017] An IPv6 address detection system based on a large language model, comprising:

[0018] The seed address acquisition module is used to obtain several active IPv6 addresses as seed addresses and construct an IPv6 seed data set;

[0019] A fine-tuning data set construction module is used to pre-classify each seed address in the IPv6 seed data set, and construct a large language model IPv6 fine-tuning data set based on the pre-classified seed addresses;

[0020] Large language model fine-tuning module, used to use the constructed IPv6 fine-tuning dataset and adopt the LoRA method to fine-tune the large language model;

[0021] The IPv6 address generation module is used to generate several IPv6 addresses and construct an IPv6 address candidate set based on the fine-tuned large language model and the vLLM accelerated reasoning framework;

[0022] The IPv6 address evaluation module is used to perform multi-dimensional evaluations on the hit rate, generation rate, diversity, innovation, and alias address ratio based on the IPv6 address candidate set, and extract active IPv6 addresses from the IPv6 address candidate set;

[0023] The IPv6 address detection module is used to merge the generated active IPv6 addresses as seed addresses with the original seed data set to obtain an updated seed data set, and thus continuously cycle to complete the detection of the IPv6 address space.

[0024] In a third aspect, the present invention further provides an electronic device, comprising: a memory for storing executable instructions; and a processor for implementing the above-mentioned large language model-based IPv6 address detection method when executing the executable instructions stored in the memory.

[0025] In a fourth aspect, the present invention further provides a computer-readable storage medium storing executable instructions for causing a processor to execute the executable instructions to implement the above-mentioned large language model-based IPv6 address detection method.

[0026] In a fifth aspect, the present invention also provides a computer program product, which includes executable instructions stored in a computer-readable storage medium; wherein, when the processor of the electronic device reads the executable instructions from the computer-readable storage medium and executes the executable instructions, the above-mentioned IPv6 address detection method based on a large language model is implemented.

[0027] One or more of the above technical solutions have the following beneficial effects:

[0028] 1. The present invention provides an IPv6 address detection method and system based on a large language model, which adopts a specific fine-tuning large language model data set construction method, that is, first pre-classifying active IPv6 addresses, namely seed addresses, and then fine-tuning the classified active IPv6 addresses to construct a data set, so as to construct a high-quality IPv6 fine-tuning data set, thereby effectively alleviating the pressure of learning features of the large language model and improving the address generation efficiency; using the constructed IPv6 fine-tuning data set, and adopting the LoRA method to fine-tune the large language model, so that the large language model can more efficiently obtain the characteristic laws of active IPv6 addresses and learn; and then, through the fine-tuning large language model, combined with the vLLM fast reasoning framework, more effective and efficient effective IPv6 address generation is achieved, the hit rate and generation rate of address generation are effectively improved, and the problem of low efficiency of the address generation algorithm during current IPv6 address detection is solved.

[0029] 2. The present invention proposes an automated evaluation tool for IPv6 address candidate sets, which conducts a comprehensive, convenient and fast evaluation of the address generation algorithm from multiple dimensions such as hit rate, generation rate, diversity, innovation, and proportion of alias addresses, thereby solving the current problem of being unable to quickly and effectively evaluate the generated IPv6 addresses, and realizing a multi-dimensional and comprehensive automated evaluation of the generated IPv6 addresses.

[0030] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] The accompanying drawings in the specification, which constitute a part of the present invention, are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations on the present invention.

[0032] Figure 1 A flowchart of an IPv6 address detection method based on a large language model according to an embodiment of the present invention;

[0033] Figure 2 A flowchart of performing data preprocessing on an IPv6 seed data set in an embodiment of the present invention;

[0034] Figure 3 It is a schematic diagram of the results of the hit rate stability experiment under different IPv6 generation methods in the embodiment of the present invention;

[0035] Figure 4 Schematic diagram of the results of the generation rate stability experiment under different IPv6 generation methods in the embodiment of the present invention. DETAILED DESCRIPTION

[0036] It should be noted that the following detailed descriptions are exemplary only, are intended to describe specific embodiments, are intended to provide further explanation of the present invention, and are not intended to limit exemplary embodiments according to the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those of ordinary skill in the art to which the present invention belongs. In addition, it should also be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0037] Embodiment 1

[0038] This embodiment provides an IPv6 address detection method based on a large language model, which can generate a valid IPv6 address and perform a comprehensive automatic evaluation on the generated IPv6 address, such as Figure 1 As shown, the method specifically comprises the following steps:

[0039] Step S1, obtain a number of active IPv6 addresses as seed addresses, and construct an IPv6 seed data set. In this embodiment, a number (eg, 50K) of active IPv6 addresses are taken as seed addresses in the public data set Hitlist to construct an IPv6 seed data set.

[0040] Step S2: pre-classify each seed address in the IPv6 seed data set, and construct a large language model IPv6 fine-tuning data set based on the pre-classified seed addresses.

[0041] In this embodiment, the IPv6 seed data set constructed in step S1 is first preprocessed, and a large language model fine-tuning data set is constructed based on all IPv6 seed addresses (i.e., active IPv6 addresses) in the data set. Figure 2 As shown, the preprocessing process is:

[0042] Step S2.1, pre-classify each seed address in the IPv6 seed data set. Through this seed address pre-classification process, the pressure of model learning features can be effectively alleviated and the address generation efficiency can be improved. Specifically, firstly adopt the existing multiple mainstream IPv6 address classification methods, such as RFC Based, Entropy Clustering and IPv62Vec, etc., to effectively classify the seed addresses; then determine the method with the most uniform classification results and use this method for pre-classification. In this embodiment, for the IPv6 seed data set, the RFC Based classification method (RFC7707 is used in this embodiment) is used to pre-classify each seed address, and the classification information of each seed address is determined, and the classification information includes: embedded IPv4 (Embedded-IPv4), embedded port number (Embedded-port), IEEE derived (IEEE-derived), low byte (Low-byte), pattern byte (Pattern-bytes), random class (Randomized), etc.

[0043] Step S2.2: Based on the pre-classified seed addresses, construct a large language model IPv6 fine-tuning data set. In this embodiment, a user input structure for the large language model is constructed, and all pre-classified seed addresses are combined to construct an IPv6 fine-tuning data set. The user input structure includes: defining roles, clarifying main tasks, declaring classification information, and specifying constraints, specifically:

[0044] (1) Role definition: Assign a specific role to the large language model;

[0045] (2) Clarify the main task: Provide a clear instruction to the large language model to guide the task of generating active IPv6 addresses;

[0046] (3) Declare classification information: By providing classification information, the large language model can more easily understand the focus and intention of the instruction, thereby reducing its burden in understanding the task and reasoning about the output;

[0047] (4) Specify constraints: Ensure that the IPv6 addresses generated by the large language model are standardized and reasonable.

[0048] Through the above steps, a high-quality IPv6 fine-tuning dataset can be constructed for efficient fine-tuning training of large models. Further, the IPv6 fine-tuning dataset constructed using the RFC Based classification method is as follows:

[0049]

[0050] "value":"You are an IPv6 research expert (i.e. role definition). IPv6 addresses are usually represented as 8 groups of hexadecimal numbers, each separated by a colon, such as 2600:3c02:0000:0000:f03c:91ff:fe69:b01a. The address consists of a network prefix (2600:3c02), a subnet ID (0000:0000) and an interface ID (f03c:91ff:fe69:b01a). According to RFC7707, the interface ID part can be divided into 6 categories, The first category is Embedded-IPv4, in which case the interface ID part is embedded in the IPv4 address of the network interface, for example, 0:0:c0a8:20a or c0:a8:2:a can be embedded in the IPv4 address 192.168.2.10. The key to determining whether an IPv6 address is active lies in the interface ID part, that is, the last 4 groups of hexadecimal numbers. An active IPv6 address means an IPv6 address that is actually being used by a device and can communicate over the network. Please provide an active IPv6 address. "

[0051]

[0052] Step S3: Use the constructed IPv6 fine-tuning dataset and adopt the LoRA method to fine-tune the large language model.

[0053] Specifically, the large language model is fine-tuned. In this embodiment, the LoRA (Low-Rank Adaptation) method is used to fine-tune the Qwen-7B-Chat large language model. Among them, the Qwen-7B-Chat large language model is an existing large-scale pre-trained language model based on the Transformer architecture, which is specially optimized for dialogue generation tasks. The model has 7 billion parameters and uses more than 2.4 trillion tokens of data for pre-training. These data not only include Chinese and English, but also cover multiple languages, codes, mathematics and other fields, ensuring the versatility and professionalism of the model. Aiming to provide high-quality, natural and fluent dialogue generation capabilities, the Qwen-7B-Chat model has been pre-trained with a large amount of text and dialogue data, and can understand and generate natural and coherent dialogues, suitable for a variety of application scenarios. In addition, in addition to basic language understanding and generation capabilities, Qwen-7B-Chat also has certain code generation and simple mathematical reasoning capabilities, and it also has the ability to learn the regularity of active IPv6 address characteristics. On this basis, this embodiment introduces a LoRA fine-tuning method, by fine-tuning the Qwen-7B-Chat large language model to make the model more suitable for the generation of IPv6 addresses.

[0054] Furthermore, the core idea of ​​the LoRA fine-tuning method is to add a bypass matrix next to the weight matrix of the model to simulate full parameter fine-tuning, thereby significantly reducing the amount of parameters that need to be trained. In this embodiment, based on the inherent low-rank characteristics of the large language model, by introducing two low-rank matrices A and B, and multiplying the two matrices and adding them to the original weight matrix in the large language model, the model can be fine-tuned without changing the weight of the entire model, which can not only maintain the performance of the model, but also significantly reduce training time and memory consumption. By fine-tuning using the LoRA method, the trainable parameters required for downstream tasks can be reduced, the hardware requirements can be reduced, and the GPU memory requirements and trainable parameters can be significantly reduced without affecting the inference speed, so that large models can be fine-tuned locally under limited hardware conditions. In addition, fine-tuning verification is performed on multiple large language models, and the effect of the LoRA fine-tuning is equivalent to or even better than the full fine-tuning.

[0055] In this embodiment, the IPv6 fine-tuning data set constructed in step S2 is used to perform LoRA fine-tuning on Qwen-7B-Chat to achieve the task of generating a valid IPv6 address. Specifically, based on the above structural fine-tuning, the specific IPv6 fine-tuning data set constructed in step S2 is used as the training set, and the training set is input into the large language model for LoRA fine-tuning and training. LoRA modifies the original forward propagation process, which can be expressed as: h = W 0 x+ΔWx=W 0x+BAx, where W 0 is the matrix parameter of the pre-trained large language model, which is always fixed; x represents input, h represents output, ΔW is the parameter to be updated, which is reflected by the two low-rank matrices A and B introduced, that is, A and B are training parameters. Through this LoRA fine-tuning method, only parameters A and B are trained and obtained, which can greatly reduce the amount of parameters in the parameter update process of the large language model and improve the training effect. In addition, this embodiment adopts the Qwen-7B-Chat large language model. Compared with other large language models such as GLM-4-9B-Chat, under the premise that all fine-tuning training parameters are set consistently, the effect of this model is inferior to Qwen-7B-Chat, but its effect is also better than the existing address generation algorithm. This further verifies that this embodiment can more efficiently obtain and learn the characteristic rules of active IPv6 addresses by using a large language model, so as to achieve the generation of valid IPv6 addresses.

[0056] Furthermore, after fine-tuning, the fine-tuning parameters are merged with the original model parameters, that is, the parameters ΔW obtained by LoRA fine-tuning training are merged with the parameters W of the original large model. 0 Fusion is performed to obtain a large language model specifically for IPv6 address generation: Qwen-7B-V6.

[0057] Step S4: Based on the fine-tuned large language model, the vLLM accelerated reasoning framework is used to generate several IPv6 addresses and construct an IPv6 address candidate set.

[0058] Considering that only a large language model with fine-tuning is used, and a suitable reasoning framework is not selected and a suitable prompt is not designed, the generation effect of the IPv6 address will not meet expectations. For this reason, this embodiment adopts an IPv6 address generation method based on a vLLM accelerated reasoning framework. Compared with using Hugging Face's transformers library for reasoning generation, it can only generate 100 IPv6 addresses in 10 minutes. After using the vLLM reasoning framework, for the same Qwen-7B-V6 model, 100,000 IPv6 addresses can be generated in 10 minutes, thereby realizing large-scale generation of IPv6 addresses, further improving reasoning efficiency, and improving address generation efficiency.

[0059] Furthermore, based on the fine-tuned large language model, the vLLM accelerated reasoning framework is used to generate IPv6 addresses. During this generation process, the corresponding input of the fine-tuned large language model is limited in the vLLM accelerated reasoning framework, such as "Please provide an active IPv6 address", so as to use the large language model for reasoning, and finally generate and output the active IPv6 address.

[0060] Step S5: Based on the IPv6 address candidate set, a multi-dimensional evaluation of hit rate, generation rate, diversity, innovation, and alias address ratio is performed, and active IPv6 addresses in the IPv6 address candidate set are extracted.

[0061] Specifically, after generating an IPv6 address, this embodiment proposes an IPv6 address automatic evaluation tool: ev6-tool, which is used to perform a multi-dimensional, convenient and fast comprehensive evaluation of the IPv6 address. According to the evaluation results, the quality of the generated candidate set can be effectively measured to further illustrate the advantages and disadvantages of the address generation algorithm. The ev6-tool evaluation tool is implemented based on Zmap. It only needs to provide a batch of IPv6 data sets to be tested, and can efficiently and automatically calculate the hit rate, generation rate, diversity, innovation, alias address ratio and other results.

[0062] Among them, the hit rate is the most common indicator for evaluating the quality of the address generation algorithm. It is the proportion of active IPv6 addresses in the generated IPv6 address candidate set. The calculation formula is:

[0063]

[0064] Where C represents the candidate set, C∩T represents the scan result using Zmapv6, and T a Represents a set of alias prefixes.

[0065] The generation rate refers to the proportion of active IPv6 addresses in the generated IPv6 address candidate set after removing the addresses that are repeated in the seed data set. This can better reflect the generation performance of an address algorithm. The calculation formula is:

[0066]

[0067] Where S represents the seed set.

[0068] Diversity refers to the differences in the IPv6 addresses in the generated IPv6 address candidate set. The greater the difference, the more diverse the generated addresses are and the higher the generation quality is. The calculation formula is:

[0069]

[0070] in, is the Jaccard similarity function, which measures whether the sampled nibble set is identical to other addresses in the candidate set; e = 100 helps to amplify the metric.

[0071] Innovation refers to the difference between the generated IPv6 address candidate set and the IPv6 seed data set, which aims to illustrate the ability of the address generation algorithm to generate new address sequences. The calculation formula is:

[0072]

[0073] At the same time, the proportion of alias addresses in the IPv6 address candidate set is determined. Alias ​​addresses refer to all addresses under the alias prefix that unconditionally respond to scan queries, that is, if 2001:db8:: / 32 is an alias prefix, then 2001:db8::20:1a is an alias address. Alias ​​addresses seriously affect the accuracy of host discovery methods because there is no mapping relationship between these addresses and unique devices. Alias ​​detection of IPv6 addresses has become a consensus in IPv6 scanning. For the detection of alias prefixes, the existing method is to first obtain the alias prefixes publicly available on the Hitlist, and then filter out the addresses under these prefixes. This method is convenient, fast and easy to implement, but the accuracy depends entirely on the quality of the publicly available alias prefix set, and some alias addresses cannot be identified. To this end, this embodiment proposes an alias prefix detection method, that is, first use IPv6toolkit to obtain the prefix information of the generated IPv6 address; then based on the prefix information, randomly generate multiple (such as 3) IPv6 addresses under each prefix, if the generated 3 IPv6 addresses are all active addresses, then the prefix is ​​an alias prefix, and all the IPv6 addresses contained in it are alias addresses. The principle of this method is: since the space contained in an IPv6 address prefix is ​​huge, the probability of randomly generating 3 addresses that are all active addresses is very small, so if the 3 addresses generated under this prefix are all active, it can be determined to be an alias prefix.

[0074] Furthermore, the proportion of alias addresses is determined based on all alias addresses in the generated IPv6 addresses identified and combined with all generated IPv6 addresses.

[0075] Through the above method, the ev6-tool tool proposed in this embodiment can efficiently and quickly perform a comprehensive evaluation of the candidate set generated by the algorithm, and evaluate the advantages and disadvantages of the address generation algorithm from multiple dimensions.

[0076] Furthermore, by using Zmap v6 to scan the generated IPv6 address candidate set, the active IPv6 addresses can be extracted. The Zmap v6 tool is used to detect the ICMPv6, 53, 443 and other ports of an IPv6 address. If there is an address response detection under a port, the address is considered to be an active address.

[0077] Step S6: The generated active IPv6 address is used as a seed address and merged with the original seed data set to obtain an updated seed data set, and this cycle is repeated continuously to complete the detection of the IPv6 address space.

[0078] Furthermore, the above method proposed in this embodiment is verified. Specifically, 50K active addresses are taken as seed addresses in the public data set Hitlist, and a 50K budget is set to perform hit rate and generation rate experiments; then a more diverse budget is used to perform algorithm experiments, as shown in Table 1 below. The final experimental results are as follows: Figure 3 and Figure 4 The experimental results show that the method of generating IPv6 addresses through a large language model is superior to the existing algorithms.

[0079] Table 1. Experiments generated under a 50K budget

[0080]

[0081] In the method proposed in this embodiment, the use of a large language model can efficiently learn the rules of existence of seed addresses through the constructed high-quality data set, thereby achieving effective IPv6 address generation.

[0082] Embodiment 2

[0083] This embodiment provides an IPv6 address detection system based on a large language model, including:

[0084] The seed address acquisition module is used to obtain several active IPv6 addresses as seed addresses and construct an IPv6 seed data set;

[0085] A fine-tuning data set construction module is used to pre-classify each seed address in the IPv6 seed data set, and construct a large language model IPv6 fine-tuning data set based on the pre-classified seed addresses;

[0086] Large language model fine-tuning module, used to use the constructed IPv6 fine-tuning dataset and adopt the LoRA method to fine-tune the large language model;

[0087] The IPv6 address generation module is used to generate several IPv6 addresses and construct an IPv6 address candidate set based on the fine-tuned large language model and the vLLM accelerated reasoning framework;

[0088] The IPv6 address evaluation module is used to perform multi-dimensional evaluations on the hit rate, generation rate, diversity, innovation, and alias address ratio based on the IPv6 address candidate set, and extract active IPv6 addresses from the IPv6 address candidate set;

[0089] The IPv6 address detection module is used to merge the generated active IPv6 addresses as seed addresses with the original seed data set to obtain an updated seed data set, and thus continuously cycle to complete the detection of the IPv6 address space.

[0090] Embodiment 3

[0091] This embodiment provides an electronic device, including: a memory, used to store executable instructions; and a processor, used to implement the above method provided in this embodiment when executing the executable instructions stored in the memory.

[0092] Embodiment 4

[0093] This embodiment also provides a computer-readable storage medium storing executable instructions. When the executable instructions are executed by a processor, the processor will be caused to execute the above method provided by this embodiment.

[0094] Embodiment 5

[0095] This embodiment provides a computer program product, which includes an executable instruction, which is a computer instruction; the executable instruction is stored in a computer-readable storage medium. When a processor of an electronic device reads the executable instruction from the computer-readable storage medium and the processor executes the executable instruction, the electronic device executes the above method provided in this embodiment.

[0096] The steps involved in the above embodiments 2 to 5 correspond to the method embodiment 1. For the specific implementation, please refer to the relevant description part of embodiment 1. The term "computer-readable storage medium" should be understood as a single medium or multiple media including one or more instruction sets; it should also be understood to include any medium that can store, encode or carry an instruction set for execution by a processor and enable the processor to execute any method in the present invention.

[0097] Those skilled in the art should understand that the modules or steps of the present invention described above can be implemented by a general-purpose computer device, or alternatively, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. The present invention is not limited to any specific combination of hardware and software.

[0098] The above description is only a preferred embodiment of the present invention. Although the specific implementation mode of the present invention is described in conjunction with the accompanying drawings, it is not a limitation of the protection scope of the present invention. Those skilled in the art should understand that on the basis of the technical solution of the present invention, various modifications or variations that can be made by those skilled in the art without creative work are still within the protection scope of the present invention.

Claims

1. A method for detecting an IPv6 address based on a large language model, characterized in that: include: Obtain several active IPv6 addresses as seed addresses and construct an IPv6 seed data set; Pre-classify each seed address in the IPv6 seed data set, and construct a large language model IPv6 fine-tuning data set based on the pre-classified seed addresses; The constructed IPv6 fine-tuning dataset is used to fine-tune the large language model using the LoRA method; Based on the fine-tuned large language model, the vLLM accelerated reasoning framework is used to generate several IPv6 addresses and construct an IPv6 address candidate set. Based on the IPv6 address candidate set, a multi-dimensional evaluation is performed on the hit rate, generation rate, diversity, innovation, and proportion of alias addresses to extract active IPv6 addresses from the IPv6 address candidate set; The generated active IPv6 addresses are used as seed addresses and merged with the original seed data set to obtain an updated seed data set. This cycle is repeated continuously to complete the detection of the IPv6 address space.

2. The IPv6 address detection method based on a large language model as claimed in claim 1, characterized in that: For the IPv6 seed data set, the RFC Based classification method is used to pre-classify each seed address and determine the classification information of each seed address; Among them, the IPv6 address used as the seed address consists of three parts: network prefix, subnet ID and interface ID. The interface ID part is pre-classified to determine the classification information of each seed address; the classification information includes: embedded IPv4, embedded port number, IEEE derivation, low byte, mode byte, and random class.

3. The IPv6 address detection method based on a large language model as claimed in claim 1, characterized in that: According to the pre-classified seed addresses, the large language model IPv6 fine-tuning dataset is constructed as follows: Construct a user input structure for a large language model and combine all pre-classified seed addresses to construct an IPv6 fine-tuning dataset. The user input structure includes: defining roles, clarifying main tasks, declaring classification information and specifying constraints.

4. The IPv6 address detection method based on a large language model as claimed in claim 1, characterized in that: The LoRA method is used to fine-tune the large language model as follows: Based on the intrinsic low-rank characteristics of the large language model, two low-rank matrices are introduced. The two low-rank matrices are multiplied and added to the original weight matrix in the large language model to complete the fine-tuning of the large language model.

5. The IPv6 address detection method based on a large language model as claimed in claim 1, characterized in that: The hit rate is the proportion of active IPv6 addresses in the generated IPv6 address candidate set; The generation rate is the proportion of active IPv6 addresses in the generated IPv6 address candidate set after removing the addresses repeated in the seed data set; The diversity refers to the differences in the IPv6 addresses in the generated IPv6 address candidate set; The innovation is the difference between the generated IPv6 address candidate set and the IPv6 seed data set.

6. The IPv6 address detection method based on a large language model as claimed in claim 1, characterized in that: The alias address ratio is determined as follows: Use IPv6toolkit to obtain the prefix information of the generated IPv6 address; Based on the prefix information, multiple IPv6 addresses are randomly generated. If all the generated multiple IPv6 addresses are active addresses, the prefix is ​​determined to be an alias prefix, and all IPv6 addresses under the alias prefix are alias addresses; Determine the alias address ratio based on all identified alias addresses and all generated IPv6 addresses.

7. An IPv6 address detection system based on a large language model, characterized in that: include: An IPv6 address detection system based on a large language model, comprising: The seed address acquisition module is used to obtain several active IPv6 addresses as seed addresses and construct an IPv6 seed data set; A fine-tuning data set construction module is used to pre-classify each seed address in the IPv6 seed data set, and construct a large language model IPv6 fine-tuning data set based on the pre-classified seed addresses; Large language model fine-tuning module, used to use the constructed IPv6 fine-tuning dataset and adopt the LoRA method to fine-tune the large language model; The IPv6 address generation module is used to generate several IPv6 addresses and construct an IPv6 address candidate set based on the fine-tuned large language model and the vLLM accelerated reasoning framework; The IPv6 address evaluation module is used to perform multi-dimensional evaluations on the hit rate, generation rate, diversity, innovation, and alias address ratio based on the IPv6 address candidate set, and extract active IPv6 addresses from the IPv6 address candidate set; The IPv6 address detection module is used to merge the generated active IPv6 addresses as seed addresses with the original seed data set to obtain an updated seed data set, and thus continuously cycle to complete the detection of the IPv6 address space.

8. An electronic device, characterized in that: include: A memory for storing executable instructions; The processor is used to implement the IPv6 address detection method based on a large language model as described in any one of claims 1 to 6 when executing the executable instructions stored in the memory.

9. A computer-readable storage medium, characterized in that: Executable instructions are stored, which are used to cause a processor to execute the executable instructions to implement the IPv6 address detection method based on a large language model as described in any one of claims 1-6.

10. A computer program product, characterized in that The computer program product includes executable instructions stored in a computer-readable storage medium; When the processor of the electronic device reads the executable instructions from the computer-readable storage medium and executes the executable instructions, the IPv6 address detection method based on the large language model described in any one of claims 1-6 is implemented.

Images