IPv6 address scanning optimization method based on adjacent association rules

Abstract

The invention belongs to the technical field of IPv6 address scanning, and relates to an IPv6 address scanning optimization method based on adjacent association rules, which comprises the following steps: collecting and preprocessing existing IPv6 address data, extracting an initial address field and generating an address distribution map; generating a preliminary association rule list by using an association rule mining algorithm, screening out high-value adjacent association rules through support degree and confidence, and ensuring that a scanning set is in a high-probability region in which an effective address possibly exists; based on the high-value rules and the address distribution map, formulating an address field for preferential scanning and a preliminary scanning strategy; by determining the scanning rate and optimizing the tool to execute the specific scanning task, the high efficiency and the resource utilization rate of the scanning process are ensured. And finally, collecting a scanning result in real time, dynamically adjusting a scanning strategy, feeding back the result to an association rule mining process, and continuously optimizing the scanning strategy. According to the invention, through an intelligent and dynamic scanning strategy, effective coverage and efficient scanning of an IPv6 huge address space are realized.

Description

Technical Field

[0001] The present application belongs to the technical field of IPv6 address scanning, and more specifically, relates to an IPv6 address scanning optimization method based on neighbor association rules. Background Art

[0002] With the rapid development of the Internet, IPv4 address resources are becoming increasingly scarce, and the IPv6 protocol has emerged. IPv6 not only greatly expands the address space, thereby alleviating the problem of IPv4 address exhaustion, but also brings many advantages such as more efficient routing and packet processing, higher security and automatic configuration capabilities. However, it is precisely because of the huge expansion of the IPv6 address space that it has also led to a series of challenges in the new generation of network management and security monitoring, especially when performing address scanning.

[0003] IP v 6 The address length is 128 bits, compared to IP v 4 32-bit address, IP v Theoretically, the address space of IPv6 can provide about 3.4×10^38 addresses. This huge address space makes the traditional IPv4 address scanning method almost infeasible in the IPv6 environment. IPv4 address scanning is usually carried out by exhaustive method or according to specific rules, but in the IPv6 environment, this method will consume extremely large computing resources and time, and it is difficult to achieve effective coverage.

[0004] In IP v In IPv4, exhaustive scanning (i.e. scanning every possible address one by one) is feasible when managing smaller networks. However, in IPv6, exhaustive scanning becomes completely infeasible due to the huge address space. Even with modern supercomputers, exhaustive scanning of the entire IPv6 address space requires astronomical amounts of time and computing resources.

[0005] Randomly selecting IPv6 addresses for scanning seems to be a feasible simplification, but this method is extremely inefficient. In such a large address space, the probability of hitting a valid address in a random scan is extremely low, resulting in a long-term scanning process without any results and serious waste of resources.

[0006] Some scanning methods try to improve efficiency by scanning specific prefixes. This method assumes that more valid addresses may be concentrated under certain prefixes, but this requires a deeper understanding of the network structure and still faces the problem of too large a scanning range and incomplete coverage. Summary of the invention

[0007] The present invention provides an IPv6 address scanning optimization method based on neighbor association rules, which is intended to solve the technical problem that the existing method consumes extremely huge computing resources and time and is difficult to achieve effective coverage.

[0008] An IPv6 address scanning optimization method based on neighbor association rules comprises the following steps:

[0009] Step 1: Collect existing IPv6 address data sets and preprocess the collected data sets;

[0010] Step 2: Extract the initial IP based on the preprocessed data set v 6 address segments and conduct statistical analysis to generate a preliminary address distribution map;

[0011] Step 3: Generate a preliminary list of association rules based on the preprocessed data set using an association rule mining algorithm; define adjacent rules based on the preliminary list of association rules to obtain an adjacent association rule list; and filter out a high-value adjacent association rule list that is higher than a threshold using support and confidence rules based on the adjacent association rule list;

[0012] Step 4: Based on the high-value adjacent association rule list and address distribution map, determine the address segment to be scanned first and generate preliminary scanning strategy tasks;

[0013] Step 5: Determine the scan rate control based on the preliminary scan strategy task, obtain the specific scan task list and execution plan, and execute it through the optimization tool;

[0014] Step 6: Collect scanning results in real time, dynamically adjust the scanning strategy, and feed the results back to association rule mining to continuously optimize the scanning strategy.

[0015] The IPv6 address scanning optimization method based on adjacent association rules effectively solves the problem of low efficiency of traditional IPv6 address scanning methods through a multi-step process. First, by collecting and preprocessing existing IPv6 address data, extracting the initial address segment and generating an address distribution map, a preliminary scanning direction is provided. Then, an association rule mining algorithm is used to generate a preliminary list of association rules, and high-value adjacent association rules are screened out by support and confidence to ensure that the scan is concentrated in the high-probability area where valid addresses may exist. Then, based on these high-value rules and address distribution maps, priority scanning address segments and preliminary scanning strategies are formulated. By determining the scanning rate and optimizing tools to perform specific scanning tasks, the efficiency and resource utilization of the scanning process are guaranteed. Finally, the scanning results are collected in real time and the scanning strategy is adjusted dynamically. The results are fed back to the association rule mining process to continuously optimize the scanning strategy. This method achieves effective coverage and efficient scanning of the huge IPv6 address space through intelligent and dynamic scanning strategies.

[0016] Preferably, step 2 comprises the following steps:

[0017] Address clustering: Based on the preprocessed IPv6 address data set, addresses are clustered according to prefixes of the same length. Address prefixes with the same length are divided into a group to generate multiple IPv6 address segments, each of which contains a set of addresses with prefixes of the same length.

[0018] Statistical analysis: traverse each address segment, calculate the total number of addresses in it, and count the number of IPv6 addresses in each address segment;

[0019] Calculate the range of each address segment: Calculate the range R of each address segment based on the prefix length Di :

[0020]

[0021] Where: P represents the length of the prefix;

[0022] Calculate the distribution density:

[0023]

[0024] Where: D i Indicates the number of IPv6 addresses in address segment i; Indicates the distribution density of address segment i;

[0025] Set density threshold: Set an initial density threshold ρ th ;

[0026] Adjust the prefix length: the distribution density of each address segment Conduct inspections;

[0027] like Then increase the prefix length P i :P′ i =P i +1;

[0028] like Then reduce the prefix length P i :P′ i =P i -1;

[0029] like The prefix length remains unchanged;

[0030] Regrouping and calculation: Regroup the IPv6 address segments according to the adjusted prefix length and recalculate the distribution density of each address segment until the density of all address segments is

[0031] Create table: Create a table including the prefix, prefix length, number of addresses, range, and density values ​​for each address segment;

[0032] Generate a distribution map: Use visualization tools to generate a heat map or bar chart to represent the distribution of IPv6 addresses and obtain a preliminary address distribution map.

[0033] Preferably, step 3 comprises the following steps:

[0034] Data conversion: Based on the preprocessed data set, convert the IPv6 address into binary form;

[0035] Data segmentation: The IPv6 address after data conversion is divided according to the prefix length to form multiple address segments of the same length;

[0036] Association rule mining: each IPv6 address segment is regarded as an item set, and the Apriori algorithm is used to mine frequent item sets from the address segment set;

[0037] Generate association rules: Generate association rules from frequent item sets and calculate the confidence of the rules:

[0038]

[0039] Where: Representation Rules 's confidence; Support(A∪B) represents the support of item set A∪B; Support(A) represents the support of item set A; Indicates two adjacent IPv6 address segments;

[0040] The support is calculated as follows:

[0041]

[0042] Where: N represents the total number of records in the data set; Count(A) represents the number of times the item set X appears in the data set;

[0043] Define the adjacency rule: set a distance threshold d to determine whether two address segments are adjacent:

[0044] Distance(A,B)=|Prefix(A)-Prefix(B)|;

[0045] Where: Distance(A,B) represents the prefix distance between address segments A and B; Prefix(A) and Prefix(B) represent the prefix values ​​of address segments A and B respectively;

[0046] Generate adjacent association rules: Based on the preliminary association rule list, filter out the association rules that meet the conditions to form an adjacent association rule list. The screening conditions are as follows:

[0047]

[0048] Support and execution calculation: For each rule in the adjacent association rule list, calculate the support and confidence;

[0049] Filter high-value rules: Set the support threshold and confidence threshold to filter out high-value adjacent association rules whose support and confidence are higher than the threshold:

[0050]

[0051] Where: σ′ represents the support threshold; γ represents the confidence threshold.

[0052] Preferably, step 4 comprises the following steps:

[0053] Rule weight calculation: Assign a weight W to each high-value adjacent association rule j , calculate the weight by combining support and execution:

[0054] W j =α·Support(R j )+B·Confidence(R j );

[0055] Where: α and β represent weight coefficients; R j represents the jth high-value adjacent association rule; Support(R j ) represents the support of the jth high-value adjacent association rule; Confidence (R j ) represents the confidence of the jth high-value adjacent association rule;

[0056] Address segment priority calculation: According to the weight of high-value adjacent association rules, for each address segment D i Calculate its priority P i :

[0057]

[0058] Where: Indicates that the address segment D is included i The set of all rules of i Indicates address segment D i Address density;

[0059] Priority scanning address segment selection: all address segments are scanned according to the priority P iSort and select the first k address segments with the highest priority as the priority scanning targets;

[0060] Generate a preliminary scanning strategy: prioritize the address segment set D priorityt Determined as the core of the preliminary scanning strategy, each address segment D i The scanning strategy includes scanning range and scanning order;

[0061] Scan range determination: For each priority scan address segment D i ,determine the specific scanning range according to its prefix length and address density;

[0062] Scan order optimization: Based on the priority of adjacent association rules and the density of address segments, the scan order is optimized, and address segments and rules with high priority are scanned first;

[0063] Generate a scan task list: Generate a specific scan strategy task list based on all determined scan scopes and sequences;

[0064] Each scanning strategy task includes the specific start address and end address of the address segment, the scanning time window and the scanning priority.

[0065] Preferably, the k value in the selection of the priority scanning address segment is adjusted based on the scanning resources and the time window, and the specific steps are as follows:

[0066] According to the resource constraints, find the maximum allowed parallel number k max :

[0067]

[0068] Where: R represents the total scan resources, and its unit is time, processing power, or memory size; E represents the average resource consumption of each project, and its unit is consistent with R; represents the floor function, which represents the largest integer not greater than x;

[0069] According to the time constraints, find the minimum required parallel number k min :

[0070]

[0071] Where: N represents the total number of items to be scanned; W represents the average scanning time of each item; T represents the total time window; represents the ceiling function, which represents the smallest integer not less than x;

[0072] Determine the final parallel number k:

[0073]

[0074] The final k is determined in k min and k max between.

[0075] Preferably, the step 5 comprises the following steps:

[0076] Initial scan rate setting:

[0077]

[0078] Where: R 0 Indicates the initial scan rate; Total_Resources indicates the total number of available scan resources; Total_Segments indicates the number of address segments that need to be scanned;

[0079] Dynamically adjust the scan rate:

[0080] R t =R t-1 ×γ;

[0081] Where: R t represents the scanning rate at time t; γ represents the dynamic adjustment factor, γ∈(0.5,1.5);

[0082] Based on the scanning rate and the scanning strategy task list obtained in step 4, a specific scanning task list L and an execution plan are generated; the tasks are assigned to the idle scanners for scanning in sequence according to the priority through the scheduler.

[0083] The beneficial effects of the present invention include:

[0084] The IPv6 address scanning optimization method based on adjacent association rules effectively solves the problem of low efficiency of traditional IPv6 address scanning methods through a multi-step process. First, by collecting and preprocessing existing IPv6 address data, extracting the initial address segment and generating an address distribution map, a preliminary scanning direction is provided. Then, an association rule mining algorithm is used to generate a preliminary list of association rules, and high-value adjacent association rules are screened out by support and confidence to ensure that the scan is concentrated in the high-probability area where valid addresses may exist. Then, based on these high-value rules and address distribution maps, priority scanning address segments and preliminary scanning strategies are formulated. By determining the scanning rate and optimizing tools to perform specific scanning tasks, the efficiency and resource utilization of the scanning process are guaranteed. Finally, the scanning results are collected in real time and the scanning strategy is adjusted dynamically. The results are fed back to the association rule mining process to continuously optimize the scanning strategy. This method achieves effective coverage and efficient scanning of the huge IPv6 address space through intelligent and dynamic scanning strategies. BRIEF DESCRIPTION OF THE DRAWINGS

[0085] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0086] Figure 1 An overall step block diagram provided for an embodiment of the present invention. DETAILED DESCRIPTION

[0087] In order to make the technical problems, technical solutions and beneficial effects to be solved by the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0088] See also Figure 1 As shown, the best embodiment of the present invention is further described;

[0089] An IPv6 address scanning optimization method based on neighbor association rules comprises the following steps:

[0090] Step 1: Collect existing IPv6 address data sets and preprocess the collected data sets;

[0091] Source: network logs, traffic monitoring data, DNS resolution records, etc.

[0092] Data type: Raw IPv6 address data.

[0093] Operations: deduplication, format conversion, and data cleaning.

[0094] Data processing standards: Ensure that each IPv6 address has a unified format, no duplication, and no errors.

[0095] The result: a clean, uniformly formatted dataset of IPv6 addresses.

[0096] Step 2: Based on the preprocessed data set, extract the initial IPv6 address segment and perform statistical analysis to generate a preliminary address distribution map;

[0097] Step 3: Generate a preliminary list of association rules based on the preprocessed data set using an association rule mining algorithm; define adjacent rules based on the preliminary list of association rules to obtain an adjacent association rule list; and filter out a high-value adjacent association rule list that is higher than a threshold using support and confidence rules based on the adjacent association rule list;

[0098] Step 4: Based on the high-value adjacent association rule list and address distribution map, determine the address segment to be scanned first and generate preliminary scanning strategy tasks;

[0099] Step 5: Determine the scan rate control based on the preliminary scan strategy task, obtain the specific scan task list and execution plan, and execute it through the optimization tool;

[0100] Step 6: Collect scanning results in real time, dynamically adjust the scanning strategy, and feed the results back to association rule mining to continuously optimize the scanning strategy.

[0101] The IPv6 address scanning optimization method based on adjacent association rules effectively solves the problem of low efficiency of traditional IPv6 address scanning methods through a multi-step process. First, by collecting and preprocessing existing IPv6 address data, extracting the initial address segment and generating an address distribution map, a preliminary scanning direction is provided. Then, an association rule mining algorithm is used to generate a preliminary list of association rules, and high-value adjacent association rules are screened out by support and confidence to ensure that the scan is concentrated in the high-probability area where valid addresses may exist. Then, based on these high-value rules and address distribution maps, priority scanning address segments and preliminary scanning strategies are formulated. By determining the scanning rate and optimizing tools to perform specific scanning tasks, the efficiency and resource utilization of the scanning process are guaranteed. Finally, the scanning results are collected in real time and the scanning strategy is adjusted dynamically. The results are fed back to the association rule mining process to continuously optimize the scanning strategy. This method achieves effective coverage and efficient scanning of the huge IPv6 address space through intelligent and dynamic scanning strategies.

[0102] As a possible implementation of this embodiment, step 2 includes the following steps:

[0103] Address clustering: Based on the preprocessed IPv6 address data set, addresses are clustered according to prefixes of the same length. Address prefixes with the same length are divided into a group to generate multiple IPv6 address segments, each of which contains a set of addresses with prefixes of the same length.

[0104] Statistical analysis: traverse each address segment, calculate the total number of addresses in it, and count the number of IPv6 addresses in each address segment;

[0105] Calculate the range of each address segment: Calculate the range of each address segment based on the prefix length

[0106]

[0107] Where: P represents the length of the prefix;

[0108] Calculate the distribution density:

[0109]

[0110] Where: D i Indicates the number of IPv6 addresses in address segment i; Indicates the distribution density of address segment i;

[0111] Set density threshold: Set an initial density threshold ρ th ;

[0112] Adjust the prefix length: the distribution density of each address segment Conduct inspections;

[0113] like Then increase the prefix length P i :P i ′ =P i +1;

[0114] like Then reduce the prefix length P i :P i ′ =P i -1;

[0115] like The prefix length remains unchanged;

[0116] Regrouping and calculation: Regroup the IPv6 address segments according to the adjusted prefix length and recalculate the distribution density of each address segment until the density of all address segments is

[0117] Create table: Create a table including the prefix, prefix length, number of addresses, range, and density values ​​for each address segment;

[0118] Generate a distribution map: Use visualization tools to generate a heat map or bar chart to represent the distribution of IPv6 addresses and obtain a preliminary address distribution map.

[0119] In this embodiment, by clustering IPv6 addresses according to prefixes of the same length, the range of the target address can be reduced, invalid scanning can be avoided, and scanning efficiency can be improved; statistical analysis and density calculation of each address segment help to understand the address distribution, thereby providing a basis for subsequent density threshold setting and prefix length adjustment; by dynamically adjusting the prefix length, the address segment density reaches the set threshold, the division of address segments is optimized, and scanning resources are concentrated in high-density areas, reducing waste.

[0120] As a possible implementation of this embodiment, step 3 includes the following steps:

[0121] Data conversion: Based on the preprocessed data set, convert the IPv6 address into binary form;

[0122] Data segmentation: The IPv6 address after data conversion is divided according to the prefix length to form multiple address segments of the same length;

[0123] Association rule mining: each IPv6 address segment is regarded as an item set, and the Apriori algorithm is used to mine frequent item sets from the address segment set;

[0124] Generate association rules: Generate association rules from frequent item sets and calculate the confidence of the rules:

[0125]

[0126] Where: Representation Rules 's confidence; Support(A∪B) represents the support of item set A∪B; Support(A) represents the support of item set A; Indicates two adjacent IPv6 address segments;

[0127] The support is calculated as follows:

[0128]

[0129] Where: N represents the total number of records in the data set; Count(A) represents the number of times the item set X appears in the data set;

[0130] Define the adjacency rule: set a distance threshold d to determine whether two address segments are adjacent:

[0131] Distance(A,B)=|Prefix(A)-Prefix(B)|;

[0132] Where: Distance(A,B) represents the prefix distance between address segments A and B; Prefix(A) and Prefix(B) represent the prefix values ​​of address segments A and B respectively;

[0133] Generate adjacent association rules: Based on the preliminary association rule list, filter out the association rules that meet the conditions to form an adjacent association rule list. The screening conditions are as follows:

[0134]

[0135] Support and execution calculation: For each rule in the adjacent association rule list, calculate the support and confidence;

[0136] Filter high-value rules: Set the support threshold and confidence threshold to filter out high-value adjacent association rules whose support and confidence are higher than the threshold:

[0137]

[0138] Where: σ′ represents the support threshold; γ represents the confidence threshold.

[0139] As a possible implementation of this embodiment, the specific steps of mining frequent itemsets from an address segment set using the Apriori algorithm are as follows:

[0140] Initialization: Input the set of IPv6 address segments after data conversion, set to D; support threshold σ, used to determine whether the item set is a frequent item set;

[0141] Generate candidate 1-item set: Find all different IPv6 address segments in the data set and generate the initial candidate 1-item set C 1 ; For each candidate 1-item set c∈C 1 , calculate its support Support(c), which is the number of times it appears in the data set divided by the total number of records in the data set N:

[0142]

[0143] Pruning: Filter out the one-item set whose support is greater than or equal to the threshold σ to form a frequent one-item set L 1 :

[0144] L 1 ={c∈C 1 |Support(c)≥σ};

[0145] Iteratively generate candidate k-item sets: starting from k=2, until no new frequent item sets are generated;

[0146] Generate candidate k-item sets: convert the frequent (k-1) item set L k-1 Connect two by two to generate candidate k-item sets C k The specific operation is to convert L k-1 If any two item sets in the set are combined, and their first (k-2) items are the same, they are merged into a k-item set:

[0147] C k ={A∪B|A,B∈L k-1 ,|A∩B|=k-2};

[0148] Pruning: Delete the itemsets that do not meet the frequent subset condition from the candidate k-item set. That is, if any (k-1) subset of the candidate k-item set is not in the frequent (k-1) item set, delete the candidate k-item set;

[0149] Support count: For each item set c∈C of candidate k k , calculate its support Support(c);

[0150] Pruning: Filter out k-item sets whose support is greater than or equal to the threshold σ to form a frequent k-item set L k :

[0151] L k ={c∈C k |Support(c)≥σ};

[0152] Termination condition: When the frequent item set L k When it is empty, the iteration is terminated and all frequent item sets L are output, that is, the set of frequent item sets generated in each iteration.

[0153] In this embodiment, the IPv6 address is converted into binary form and divided according to the prefix length, so that the data structure is more suitable for subsequent association rule mining. The frequent item sets are mined by the Apriori algorithm to generate association rules, which can discover the potential relationship between IPv6 address segments and help optimize the scanning path; a distance threshold is set to filter out adjacent association rules, making the scanning strategy more targeted; by setting support and confidence thresholds, high-value adjacent association rules are filtered out to ensure that scanning resources are concentrated in the most likely target area.

[0154] As a possible implementation of this embodiment, step 4 includes the following steps:

[0155] Rule weight calculation: Assign a weight W to each high-value adjacent association rule j , calculate the weight by combining support and execution:

[0156] W j =α·Support(R j )+β·Confidence(R j );

[0157] Where: α and β represent weight coefficients; R j represents the jth high-value adjacent association rule; Support(R j ) represents the support of the jth high-value adjacent association rule; Confidence (R j ) represents the confidence of the jth high-value adjacent association rule;

[0158] Address segment priority calculation: According to the weight of high-value adjacent association rules, for each address segment D i Calculate its priority P i :

[0159]

[0160] Where: Indicates that the address segment D is included i The set of all rules of i Indicates address segment D i Address density;

[0161] Priority scanning address segment selection: all address segments are scanned according to the priority P i Sort and select the first k address segments with the highest priority as the priority scanning targets;

[0162] Generate a preliminary scanning strategy: prioritize the address segment set D priorityt Determined as the core of the preliminary scanning strategy, each address segment D i The scanning strategy includes scanning range and scanning order;

[0163] Scan range determination: For each priority scan address segment D i ,determine the specific scanning range according to its prefix length and address density;

[0164] Scan order optimization: Based on the priority of adjacent association rules and the density of address segments, the scan order is optimized, and address segments and rules with high priority are scanned first;

[0165] Generate a scan task list: Generate a specific scan strategy task list based on all determined scan scopes and sequences;

[0166] Each scanning strategy task includes the specific start address and end address of the address segment, the scanning time window and the scanning priority.

[0167] In this embodiment, a weight is assigned to each high-value adjacent association rule, and the weight is calculated by combining the support and confidence, so that more important rules are given priority in the scanning strategy; according to the weight of the high-value adjacent association rule, the priority of each address segment is calculated, so that the address segment with a high priority can be scanned first; according to the address segment with a high priority, a preliminary scanning strategy is generated, including a specific scanning range and sequence, to ensure that the scanning process is efficient and orderly.

[0168] As a possible implementation of this embodiment, the k value in the selection of the priority scanning address segment is adjusted based on the scanning resources and the time window, and the specific steps are as follows:

[0169] According to the resource constraints, find the maximum allowed parallel number k mix :

[0170]

[0171] Where: R represents the total scan resources, and its unit is time, processing power, or memory size; E represents the average resource consumption of each project, and its unit is consistent with R; represents the floor function, which represents the largest integer not greater than x;

[0172] According to the time constraints, find the minimum required parallel number k min :

[0173]

[0174] Where: N represents the total number of items to be scanned; W represents the average scanning time of each item; T represents the total time window; represents the ceiling function, which represents the smallest integer not less than x;

[0175] Determine the final parallel number k:

[0176]

[0177] The final k is determined in k min and k max between.

[0178] In this embodiment, the k value of the parallel scan is dynamically adjusted according to the scan resources and time window to ensure that the scan efficiency is maximized within the resource and time constraints; the dual constraints of resources and time are comprehensively considered to optimize the number of parallel scans to ensure that the scan task is completed efficiently within a controllable range.

[0179] As a possible implementation of this embodiment, step 5 includes the following steps:

[0180] Initial scan rate setting:

[0181]

[0182] Where: R 0 Indicates the initial scan rate; Total_Resource indicates the total available scan resources; Total_Segments indicates the number of address segments that need to be scanned;

[0183] Dynamically adjust the scan rate:

[0184] R t =R t-1 ×γ;

[0185] Where: R t represents the scanning rate at time t; γ represents the dynamic adjustment factor, γ∈(0.5,1.5);

[0186] Based on the scanning rate and the scanning strategy task list obtained in step 4, a specific scanning task list L and an execution plan are generated; the tasks are assigned to the idle scanners for scanning in sequence according to the priority through the scheduler.

[0187] In this embodiment, the initial scanning rate setting and dynamic adjustment mechanism ensure the rational allocation and optimal utilization of resources; the dynamic adjustment of the scanning rate and the priority scheduling mechanism improve the overall scanning efficiency and effect; and make the scanning system have good flexibility and adaptability, able to cope with various changes; the specific task list and execution plan ensure the orderly progress of the scanning tasks and reduce task conflicts and duplications.

[0188] As a possible implementation of this embodiment, step 6 includes the following steps:

[0189] Analyze the collected scan result data in real time to extract useful information to adjust the scan strategy. The main analysis contents include:

[0190] Scan success rate: the ratio of the number of valid IPv6 addresses scanned in each time period to the total number of scanned addresses:

[0191]

[0192] Where: V t Indicates the number of valid IPv6 addresses scanned at time t; TotalScanned t Indicates the total number of addresses scanned at time t;

[0193] Average scan time:

[0194]

[0195] Where: T t TotalTasks represents the total time taken by all scanning tasks at time t; t Indicates the total number of scan tasks executed at time t; AugTime t represents the average scanning time of the scanning task at time t;

[0196] Network load changes:

[0197] LoadChange t =N t -N t-1 ;

[0198] Where: LoadChange t Indicates the network load change value at time t; N t represents the network load value at time t;

[0199] Dynamically adjust the scanning strategy: adjust the scanning rate factor according to the scanning success rate and network load:

[0200]

[0201] If the scanning success rate is higher than the preset threshold and the network load change is within an acceptable range, then γ = 1.1, indicating that the scanning rate is appropriately increased;

[0202] If the scanning success rate is lower than the preset threshold or the network load change exceeds the acceptable range, γ = 0.9, indicating that the scanning rate is appropriately reduced;

[0203] In other cases, γ = 1, indicating that the scanning rate remains unchanged;

[0204] New scan rate:

[0205] R t+1 =R t ×γ;

[0206] Where: R t Indicates the current scanning rate; R t+1 Indicates the adjusted scan rate;

[0207] Adjust the priority scanning address segment:

[0208] Based on the scan results, the list of high-value adjacent association rules is updated.

[0209] If the scanning success rate of some address segments is significantly higher than that of other address segments, the priority of these address segments is increased.

[0210] On the contrary, if the scanning success rate of certain address segments is significantly lower than expected, the priorities of these address segments are reduced or their association rules are re-evaluated.

[0211] Feedback to the association rule mining algorithm: Feedback the real-time collected scanning structure and adjusted strategy to the association rule mining algorithm to optimize the association rule mining process:

[0212] Feedback parameters include: the number of valid IPv6 addresses scanned, the execution status of the scan task, and the adjusted priority list;

[0213] The association rule mining algorithm recalculates the support and confidence of the association rules based on the feedback data:

[0214]

[0215] Where: Count(A i ∩V t ) indicates that the same as rule A iThe number of valid IPv6 addresses associated with the scanned address. t Indicates the total number of geological scans at time t; Count(A i ) indicates that the same as rule A i The total number of IPv6 addresses associated;

[0216] Updated list of high-value adjacent association rules:

[0217] Redefine the threshold for high-value association rules.

[0218] Filter out a new list of high-value adjacent association rules.

[0219] In this embodiment, the scanning rate is dynamically adjusted through real-time analysis of the scanning success rate and network load changes. When the network load is low and the scanning success rate is high, the scanning rate is appropriately increased to improve resource utilization and scanning efficiency; conversely, when the network load is high or the scanning success rate is low, the scanning rate is reduced to avoid wasting resources and reducing network stability; by calculating the average scanning time, problems in the execution of scanning tasks can be discovered and adjusted in a timely manner, the scanning process can be further optimized, and the overall scanning efficiency can be improved.

[0220] According to the scanning results, the priority of high-value address segments is updated in real time, and the scanning frequency of these address segments is increased to ensure that limited scanning resources are concentrated in areas where valid IPv6 addresses are more likely to be found, thereby improving the success rate and effectiveness of the scan. The scanning results are fed back to the association rule mining algorithm to optimize the rule mining process, making the support and confidence of the association rules more accurate, and further improving the scientificity and effectiveness of the scanning strategy.

[0221] By presetting thresholds and acceptable ranges, the system can be dynamically adjusted according to real-time conditions, enhancing the system's adaptability to different network environments and load conditions. By feeding back the scanning results and adjustment strategies to the association rule mining algorithm in real time, a closed-loop feedback system is built, enabling the scanning strategy to continuously optimize and improve itself, enhancing the system's robustness and continuous improvement capabilities.

[0222] By accurately calculating and judging the scanning success rate and network load changes, the scanning rate can be adjusted more accurately to avoid the impact of too high or too low scanning rates on the accuracy of scanning results; by real-time feedback and recalculation of the support and confidence of association rules, the accuracy and effectiveness of association rules are ensured, so that the scanning strategy can more accurately locate valid IPv6 addresses.

[0223] Through real-time monitoring of changes in network load, network congestion and performance degradation caused by excessive scanning can be avoided, ensuring that the impact of scanning activities on normal network operations is minimized; through comprehensive evaluation of scanning success rate and network load, scanning resources can be reasonably allocated and utilized to avoid resource waste and improve overall system performance and resource utilization.

[0224] The above are only preferred embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. An IPv6 address scanning optimization method based on neighbor association rules, characterized in that: The following steps are involved: Step 1: Collect existing IPv6 address data sets and preprocess the collected data sets; Step 2: Based on the preprocessed data set, extract the initial IPv6 address segment and perform statistical analysis to generate a preliminary address distribution map; Step 3: Generate a preliminary list of association rules based on the preprocessed data set using an association rule mining algorithm; define adjacent rules based on the preliminary list of association rules to obtain an adjacent association rule list; and filter out a high-value adjacent association rule list that is higher than a threshold using support and confidence rules based on the adjacent association rule list; Step 4: Based on the high-value adjacent association rule list and address distribution map, determine the address segment to be scanned first and generate preliminary scanning strategy tasks; Step 5: Determine the scan rate control based on the preliminary scan strategy task, obtain the specific scan task list and execution plan, and execute it through the optimization tool; Step 6: Collect scanning results in real time, dynamically adjust the scanning strategy, and feed the results back to association rule mining to continuously optimize the scanning strategy.

2. The method for optimizing IPv6 address scanning based on neighbor association rules according to claim 1, characterized in that: The step 2 comprises the following steps: Address clustering: Based on the preprocessed IPv6 address data set, addresses are clustered according to prefixes of the same length. Address prefixes with the same length are divided into a group to generate multiple IPv6 address segments, each of which contains a set of addresses with prefixes of the same length. Statistical analysis: traverse each address segment, calculate the total number of addresses in it, and count the number of IPv6 addresses in each address segment; Calculate the range of each address segment: Calculate the range of each address segment based on the prefix length Where: P represents the length of the prefix; Calculate the distribution density: Where: D i Indicates the number of IPv6 addresses in address segment i; Indicates the distribution density of address segment i; Set density threshold: Set an initial density threshold ρ th ; Adjust the prefix length: the distribution density of each address segment Conduct inspections; like Then increase the prefix length P i :P i ′ =P i +1; like Then reduce the prefix length P i :P i ′ =P i -1; like The prefix length remains unchanged; Regrouping and calculation: Regroup the IPv6 address segments according to the adjusted prefix length and recalculate the distribution density of each address segment until the density of all address segments is Create table: Create a table including the prefix, prefix length, number of addresses, range, and density values ​​for each address segment; Generate a distribution map: Use visualization tools to generate a heat map or bar chart to represent the distribution of IPv6 addresses and obtain a preliminary address distribution map.

3. The IPv6 address scanning optimization method based on neighbor association rules as described in claim 1 is characterized in that: The step 3 comprises the following steps: Data conversion: Based on the preprocessed data set, convert the IPv6 address into binary form; Data segmentation: The IPv6 address after data conversion is divided according to the prefix length to form multiple address segments of the same length; Association rule mining: each IPv6 address segment is regarded as an item set, and the Apriori algorithm is used to mine frequent item sets from the address segment set; Generate association rules: Generate association rules from frequent item sets and calculate the confidence of the rules: Where: Representation Rules 's confidence; Support(A∪B) represents the support of item set A∪B; Support(A) represents the support of item set A; Indicates two adjacent IPv6 address segments; The support is calculated as follows: Where: N represents the total number of records in the data set; Count(A) represents the number of times the item set X appears in the data set; Define the adjacency rule: set a distance threshold d to determine whether two address segments are adjacent: Distance(A,B)=|Prefix(A)-Prefix(B)|; Where: Distance(A,B) represents the prefix distance between address segments A and B; Prefix(A) and Prefix(B) represent the prefix values ​​of address segments A and B respectively; Generate adjacent association rules: Based on the preliminary association rule list, filter out the association rules that meet the conditions to form an adjacent association rule list. The screening conditions are as follows: Support and execution calculation: For each rule in the adjacent association rule list, calculate the support and confidence; Filter high-value rules: Set the support threshold and confidence threshold to filter out high-value adjacent association rules whose support and confidence are higher than the threshold: Where: σ′ represents the support threshold; γ represents the confidence threshold.

4. The IPv6 address scanning optimization algorithm based on neighbor association rules according to claim 1, characterized in that: The step 4 comprises the following steps: Rule weight calculation: Assign a weight W to each high-value adjacent association rule j , calculate the weight by combining support and execution: W j =α·Support(R j )+β·Confidence(R j ); Where: α and β represent weight coefficients; R j represents the jth high-value adjacent association rule; Support(R j ) represents the support of the jth high-value adjacent association rule; Confidence (R j ) represents the confidence of the jth high-value adjacent association rule; Address segment priority calculation: According to the weight of the high-value adjacent association rule, for each address segment D i Calculate its priority P i : Where: Indicates that the address segment D is included i The set of all rules of i Indicates address segment D i Address density; Priority scanning address segment selection: all address segments are scanned according to the priority P i Sort and select the first k address segments with the highest priority as the priority scanning targets; Generate a preliminary scanning strategy: prioritize the address segment set D priorityt Determined as the core of the preliminary scanning strategy, each address segment D i The scanning strategy includes scanning range and scanning order; Scan range determination: For each priority scan address segment D i ,determine the specific scanning range according to its prefix length and address density; Scan order optimization: Based on the priority of adjacent association rules and the density of address segments, the scan order is optimized, and address segments and rules with high priority are scanned first; Generate a scan task list: Generate a specific scan strategy task list based on all determined scan scopes and sequences; Each scanning strategy task includes the specific start address and end address of the address segment, the scanning time window and the scanning priority.

5. The IPv6 address scanning optimization algorithm based on neighbor association rules according to claim 4 is characterized in that: The k value in the selection of the priority scanning address segment is adjusted based on the scanning resources and the time window, and the specific steps are as follows: According to the resource constraints, find the maximum allowed parallel number k max : Where: R represents the total scan resources, and its unit is time, processing power, or memory size; E represents the average resource consumption of each project, and its unit is consistent with R; represents the floor function, which represents the largest integer not greater than x; According to the time constraints, find the minimum required parallel number k min : Where: N represents the total number of items to be scanned; W represents the average scanning time of each item; T represents the total time window; represents the ceiling function, which represents the smallest integer not less than x; Determine the final parallel number k: The final k is determined in k min and k max between.

6. The IPv6 address scanning optimization algorithm based on neighbor association rules according to claim 1, characterized in that: The step 5 comprises the following steps: Initial scan rate setting: Where: R0 represents the initial scan rate; Total_Resources represents the total number of available scan resources; Total_Segments represents the number of address segments that need to be scanned; Dynamically adjust the scan rate: R t =R t-1 ×γ; Where: R t represents the scanning rate at time t; γ represents the dynamic adjustment factor, γ∈(0.5,1.5); Based on the scanning rate and the scanning strategy task list obtained in step 4, a specific scanning task list L and an execution plan are generated; the tasks are assigned to the idle scanners for scanning in sequence according to the priority through the scheduler.

Images