IPv6 address scanning efficiency improving method based on multi-dimensional scoring model

Abstract

The invention belongs to the technical field of IPv6 scanning, and relates to an IPv6 address scanning efficiency improvement method based on a multi-dimensional scoring model, and the method comprises the steps: obtaining and cleaning multi-dimensional data from an existing IPv6 address library, BGP routing information, DNS logs and passive flow detection data, and then carrying out the classification according to ISP, and extracting the activity and proximity characteristics. Thirdly, a multi-dimensional scoring model based on a random forest is constructed, classification results and features are selected, and the score of each IPv6 address is generated; the address is divided into address fields with preferential scores through descending sorting according to the scores, and the address fields with high scores are preferentially scanned by adopting a parallel scanning technology. Meanwhile, the scanning sequence and address division are dynamically adjusted according to real-time feedback, model training data are continuously updated, and the scoring model is continuously optimized. According to the method, through intelligent scoring and sorting, the scanning range is remarkably reduced, and the scanning efficiency and accuracy are improved.

Description

Technical Field

[0001] This application belongs to the technical field of IPv6 address scanning, and more specifically, it relates to a method for improving the efficiency of IPv6 address scanning based on a multi-dimensional scoring model. Background Art

[0002] IPv6 is the sixth version of the Internet Protocol, aiming to replace the current IPv4 (Internet Protocol version 4). The original intention of IPv6 design is to solve the problem of IPv4 address space exhaustion. IPv4 uses a 32-bit address space, which can provide approximately 4.3 billion independent addresses, while IPv6 uses a 128-bit address space, which can theoretically provide approximately 3.4×10^38 addresses. Such a huge address space enables IPv6 to allocate independent IP addresses to every network device globally, completely solving the problem of IPv4 address shortage.

[0003] However, the huge address space of IPv6 also brings new challenges, especially in the fields of network scanning and security. Traditional IPv4 network scanning technologies, such as using "ping scanning" or "port scanning", rely on the brute-force method, that is, trying every possible IP address one by one. This method is feasible in the IPv4 environment because the address space is relatively small. However, in the IPv6 environment, the brute-force method is obviously unworkable because even with the most powerful computing resources, it is impossible to scan all IPv6 addresses within a reasonable time. Summary of the Invention

[0004] The present invention provides a method for improving the efficiency of IPv6 address scanning based on a multi-dimensional scoring model, aiming to solve the technical problem that it is also impossible to scan all IPv6 addresses within a reasonable time.

[0005] The method for improving the efficiency of IPv6 address scanning based on a multi-dimensional scoring model includes the following steps:

[0006] Step 1: Obtain known active addresses from the existing IPv6 address library, collect BGP routing information, DNS logs, and passive traffic detection data, and clean and deduplicate the data to obtain multi-dimensional data related to IPv6 addresses;

[0007] Step 2: Classify IPv6 addresses according to ISPs based on the obtained multi-dimensional data related to IPv6 addresses;

[0008] Step 3: Extract features related to activity based on the classification results and calculate the proximity features of each address to obtain activity features and proximity features;

[0009] Step 4: Construct a multi-dimensional scoring model based on random forest, perform feature selection on the obtained multi-dimensional data, classification results, proximity features, and activity features related to IPv6 addresses, use the features obtained after feature selection as the input of the multi-dimensional scoring model, and obtain the score of each IPv6 address;

[0010] Step 5: Sort all IPv6 addresses in descending order of scores, divide the addresses into several address segments, each address segment contains a group of similar addresses, and determine the scanning priority according to the scores of the address segments;

[0011] Step 6: Adopt parallel scanning technology, give priority to scanning the address segments with high scores, adjust the scanning order and address segment division according to real-time feedback, record the scanning results, update the model training data, and continuously optimize the multi-dimensional scoring model.

[0012] The present invention significantly improves the efficiency of IPv6 address scanning through a method based on a multi-dimensional scoring model, and solves the technical problem that it is impossible to scan all IPv6 addresses within a reasonable time. First, multi-dimensional data is obtained and cleaned from the existing IPv6 address library, BGP routing information, DNS logs, and passive traffic detection data, and then classified by ISP and active and proximity features are extracted. Then, a multi-dimensional scoring model based on random forest is constructed, the classification results and features are selected, and the score of each IPv6 address is generated. By sorting in descending order of scores, the addresses are divided into score-prioritized address segments, and parallel scanning technology is adopted to give priority to scanning high-score address segments. At the same time, the scanning order and address division are dynamically adjusted according to real-time feedback, and the model training data is continuously updated to continuously optimize the scoring model. This method significantly reduces the scanning range, improves the scanning efficiency and accuracy through intelligent scoring and sorting.

[0013] Preferably, step 2 includes the following steps:

[0014] Extract IPS information: Extract the IPv6 address prefix and the corresponding autonomous system information from the BGP routing information, and use the mapping table between the autonomous system number and the IPS to determine the ISP to which each IPv6 address belongs;

[0015] Classification: According to the IPS information, label each IPv6 address with the corresponding ISP label, and group the IPv6 addresses according to the ISP label;

[0016] Data storage: Store the classified IPv6 addresses and their corresponding IPS labels in a structured data format.

[0017] Preferably, the extraction of the activity feature includes the following steps:

[0018] Query frequency: Count the number of queries of each IPv6 address in the DNS log:

[0019]

[0020] Wherein: QF i represents the query frequency of the i-th IPv6 address; N dns (i) represents the number of DNS queries of the i-th IPv6 address within the time period T; T represents the specified time period;

[0021] Traffic frequency: Count the number of occurrences of each IPv6 address in passive traffic detection:

[0022]

[0023] Wherein: TF i represents the traffic frequency of the i-th IPv6 address; N traffic (i) represents the number of traffic occurrences of the i-th IPv6 address within the time period T.

[0024] Preferably, the calculating the proximity feature includes the following steps:

[0025] Data preparation: Select address data within the same ISP group from the classification results of IPv6 addresses, and calculate the proximity feature of each address;

[0026] Proximity feature calculation: Based on the prefix of the IPv6 address, calculate the distance between each address and its nearest neighbor:

[0027]

[0028] Wherein: DW i represents the distance weight of the i-th IPv6 address; Neighbors(i) represents the set of neighbor addresses belonging to the same ISP group as the i-th IPv6 address; dist(i, j) represents the distance between the i-th IPv6 address and the j-th IPv6 address; |Neighbors(i)| represents the number of the neighbor address set; ∈ is used to prevent division by zero, and the value is 10 -6 ;

[0029]

[0030] Wherein: bit ik represents the k-th bit of the i-th IPv6 address; bit jk represents the k-th bit of the j-th IPv6 address; k represents the position of the bit, ranging from 1 to 128.

[0031] Preferably, the step 4 includes the following steps:

[0032] Feature Selection: Use the random forest algorithm for feature selection to determine the features that have the most influence on the IPv6 address activity score;

[0033]

[0034] Where: Importance(f) represents the importance of feature f; n trees represents the number of trees in the random forest; ImpurityDecrease t (f) represents the decrease in impurity of feature f in the t-th tree;

[0035] According to the results of feature selection, select the most important features to construct the final multi-dimensional scoring model; Use the random forest algorithm to train the multi-dimensional scoring model again, with the input being the selected most important features and the output being the scores of each IPv6 address;

[0036] Calculate the score: Use the trained multi-dimensional scoring model to calculate the scores of each IPv6 address, store the scores of each IPv6 address in a result set, and the format of the result set includes: IPv6 address, score, and each feature value used to calculate the score.

[0037] Preferably, the loss function of the multi-dimensional scoring model uses the mean squared error loss function.

[0038] Preferably, step 5 includes the following steps:

[0039] Sort all the IPv6 addresses obtained in step 4 in descending order according to their scores:

[0040] Sorted Addresses =sort(IPv6 Addresses ,key=Score,order=desc);

[0041] Where: Sorted Addresses represents the sorted list of IPv6 addresses; IPv6 Addresses represents the set of all IPv6 addresses; Score represents the score of each address; sort represents the sorting function; key represents the keyword used for sorting; order=desc represents the sorting order as descending;

[0042] Divide the sorted IPv6 addresses into several address segments, each address segment contains a group of similar addresses, and use a fixed-size address segment for division:

[0043] Address Segments ={Sorted Addresses [i:i + K]|i=0,K,2K,...,N - K};

[0044] Where: Address Segments represents the set of address segments after division; Sorted Addresses [i:i + K] represents k consecutive addresses starting from index i in the sorted address list; i represents the starting index of the current address segment, taking 0, K, 2K,..., N - K in sequence; K represents the number of addresses included in each address segment; N represents the total number of sorted IPv6 addresses;

[0045] Calculate the average score of each address segment as the score of this address segment:

[0046]

[0047] Where: Segment_Score j represents the average score of the jth address segment; Score (j-1)K+i represents the score of the ith address in the jth address segment, with the index starting from (j - 1)K + i;

[0048] Sort all address segments in descending order according to the scores of the address segments to determine the scanning priorities of each address segment.

[0049] Preferably, step 6 includes the following steps:

[0050] Allocate scanning tasks: Allocate the address segments with high priorities determined in step 5 to multiple scanners for parallel scanning;

[0051] Start parallel scanning: Each scanner simultaneously starts scanning the allocated address segments and records the scanning results;

[0052] Collect scanning feedback: Collect the real-time scanning feedback of each scanner, including the scanning success rate and response time metrics;

[0053] Adjust the scanning order: Adjust the scanning order according to the scanning feedback, and preferentially scan the address segments with high scanning success rates and short response times:

[0054]

[0055] Where: Priority i represents the priority of the ith address segment; f represents the function for adjusting the priority according to the feedback;

[0056] Redivide the address segments: Redivide the address segments according to the adjusted priorities to ensure that the high-priority address segments obtain more scanning resources;

[0057] Record the scanning logs: Record the logs of each scan, including the scanning time, scanner ID, scanned address segments and their results;

[0058] Collect training data: Extract the latest scan results from the database as the training data for the multi-dimensional scoring model;

[0059] Update the multi-dimensional scoring model: Retrain the multi-dimensional scoring model and optimize the model parameters using the latest training data;

[0060] Replace the old model: Replace the old multi-dimensional scoring model with the updated one.

[0061] The beneficial effects of the present invention include:

[0062] The present invention significantly improves the efficiency of IPv6 address scanning by a method based on a multi-dimensional scoring model, and solves the technical problem that it is impossible to scan all IPv6 addresses within a reasonable time. First, multi-dimensional data is obtained and cleaned from the existing IPv6 address library, BGP routing information, DNS logs, and passive traffic detection data, and then classified by ISP and active and proximity features are extracted. Then, a multi-dimensional scoring model based on random forest is constructed, the classification results and features are selected, and a score for each IPv6 address is generated. By sorting the addresses in descending order of scores, the addresses are divided into address segments with priority scores, and a parallel scanning technology is adopted to preferentially scan the high-score address segments. At the same time, the scanning order and address division are dynamically adjusted according to real-time feedback, and the model training data is continuously updated to continuously optimize the scoring model. This method significantly reduces the scanning range, improves the scanning efficiency and accuracy through intelligent scoring and sorting. Description of the Drawings

[0063] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings required for the embodiments or the description of the prior art. Obviously, the following drawings are only some embodiments of the present application. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0064] Figure 1 It is the overall step block diagram provided by the embodiment of the present invention. Detailed Embodiments

[0065] In order to make the technical problems, technical solutions, and beneficial effects to be solved by the present application clearer, the following further details the present application in conjunction with the drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0066] See Figure 1 As shown, a further description of the optimal embodiment of the present invention is given;

[0067] Method for improving the scanning efficiency of IPv6 addresses based on a multi-dimensional scoring model, including the following steps:

[0068] Step 1: Obtain known active addresses from the existing IPv6 address library, collect BGP routing information, DNS logs, and passive traffic detection data, and clean and deduplicate the data to obtain multi-dimensional data related to IPv6 addresses;

[0069] Obtain known active addresses from the existing IPv6 address library.

[0070] Collect BGP routing information to understand address allocation and routing situations.

[0071] Obtain network activity data such as DNS logs and passive traffic monitoring data.

[0072] Clean and deduplicate to ensure the accuracy and consistency of the data.

[0073] Step 2: Classify IPv6 addresses according to ISPs based on the obtained multi-dimensional data related to IPv6 addresses;

[0074] Step 3: Extract features related to activity based on the classification results, calculate the proximity features of each address, and obtain activity features and proximity features;

[0075] Step 4: Build a multi-dimensional scoring model based on random forest, perform feature selection on the obtained multi-dimensional data, classification results, proximity features, and activity features related to IPv6 addresses, use the features obtained after feature selection as the input of the multi-dimensional scoring model, and obtain the scores of each IPv6 address;

[0076] Step 5: Sort all IPv6 addresses in descending order of scores, divide the addresses into several address segments, each address segment contains a group of similar addresses, and determine the scanning priority according to the scores of the address segments;

[0077] Step 6: Adopt parallel scanning technology, give priority to scanning the address segments with high scores, adjust the scanning order and address segment division according to real-time feedback, record the scanning results, update the model training data, and continuously optimize the multi-dimensional scoring model.

[0078] The present invention significantly improves the efficiency of IPv6 address scanning through a method based on a multi-dimensional scoring model, and solves the technical problem of being unable to scan all IPv6 addresses within a reasonable time. First, multi-dimensional data is obtained and cleaned from the existing IPv6 address library, BGP routing information, DNS logs, and passive traffic detection data, and then classified by ISP and the activity and proximity features are extracted. Next, a multi-dimensional scoring model based on random forest is constructed, the classification results and features are selected, and a score for each IPv6 address is generated. By sorting the addresses in descending order of scores, the addresses are divided into address segments with priority scores, and a parallel scanning technology is adopted to preferentially scan the high-score address segments. At the same time, the scanning order and address division are dynamically adjusted according to real-time feedback, and the model training data is continuously updated to continuously optimize the scoring model. This method significantly reduces the scanning range, improves the scanning efficiency and accuracy through intelligent scoring and sorting.

[0079] As a possible implementation manner of this embodiment, step 2 includes the following steps:

[0080] Extract IPS information: Extract the IPv6 address prefix and the corresponding autonomous system information from the BGP routing information, and use the mapping table between the autonomous system number and the IPS to determine the ISP to which each IPv6 address belongs;

[0081] Classification: According to the IPS information, assign the corresponding ISP label to each IPv6 address, and group the IPv6 addresses according to the ISP label;

[0082] Data storage: Store the classified IPv6 addresses and their corresponding IPS labels in a structured data format.

[0083] In this embodiment, by extracting the IPv6 address prefix and autonomous system information from the BGP routing information and using this information to determine the ISP to which each IPv6 address belongs, the IPv6 addresses can be classified more accurately. This avoids misclassification of addresses and improves the accuracy of data processing.

[0084] As a possible implementation manner of this embodiment, the extraction of the activity feature includes the following steps:

[0085] Query frequency: Count the number of queries of each IPv6 address in the DNS logs:

[0086]

[0087] Where: QF i represents the query frequency of the i-th IPv6 address; N dns (i) represents the number of DNS queries of the i-th IPv6 address within the time period T; T represents the specified time period;

[0088] Traffic frequency: Count the number of occurrences of each IPv6 address in passive traffic detection:

[0089]

[0090] Where: TF i represents the traffic frequency of the i-th IPv6 address; N traffic (i) represents the number of traffic occurrences of the i-th IPv6 address within the time period T.

[0091] In this embodiment, by counting the number of queries of each IPv6 address in the DNS log and the number of occurrences in passive traffic detection, active addresses that are frequently used can be effectively identified. These active addresses are more likely to exist in actual use. Therefore, preferentially scanning these addresses can improve the hit rate of scanning. The activity feature is obtained based on data statistics over a period of time and can reflect the dynamic changes of the addresses. In this way, the scanning strategy can be adjusted in real time according to the changes in actual network traffic and DNS queries, improving the real-time performance and effectiveness of scanning.

[0092] As a possible implementation manner of this embodiment, the calculation of the proximity feature includes the following steps:

[0093] Data preparation: Select address data within the same ISP group from the classification results of IPv6 addresses and calculate the proximity feature of each address;

[0094] Proximity feature calculation: Based on the prefix of the IPv6 address, calculate the distance between each address and its nearest neighbor:

[0095]

[0096] Where: DW i represents the distance weight of the i-th IPv6 address; Neighbors(i) represents the set of neighbor addresses belonging to the same ISP group as the i-th IPv6 address; dist(i, j) represents the distance between the i-th IPv6 address and the j-th IPv6 address; |Neighbors(i)| represents the number of neighbor address sets; ∈ is used to prevent division by zero and takes a value of 10 -6 ;

[0097]

[0098] Where: bit ik represents the k-th binary bit of the i-th IPv6 address; bit jk represents the k-th binary bit of the j-th IPv6 address; k represents the position of the binary bit, ranging from 1 to 128.

[0099] In this embodiment, by calculating the distance between each IPv6 address and its nearest neighbor, the active situation in certain local areas can be identified, and the addresses in these areas may have similar usage situations. Prioritizing the scanning of these areas helps to discover more active addresses in a shorter time; the calculation of the proximity feature can help to discover some addresses that are not frequent but may be important, preventing these addresses from being missed during the scanning process and improving the comprehensiveness of the scanning.

[0100] As a possible implementation manner of this embodiment, step 4 includes the following steps:

[0101] Feature selection: Use the random forest algorithm for feature selection to determine the features that have the most influence on the IPv6 address activity score;

[0102]

[0103] In the formula: Importance(f) represents the importance of feature f; n trees represents the number of trees in the random forest; ImpurityDecrease t (f) represents the decrease in impurity of feature f in the t-th tree;

[0104] According to the results of feature selection, select the most important features to construct the final multi-dimensional scoring model; use the random forest algorithm to train the multi-dimensional scoring model again, with the input being the selected most important features and the output being the score of each IPv6 address;

[0105] Calculate the score: Use the trained multi-dimensional scoring model to calculate the score of each IPv6 address, and store the score of each IPv6 address in a result set. The format of the result set includes: IPv6 address, score, and each feature value used to calculate the score.

[0106] In this embodiment, using the random forest algorithm for feature selection can identify the features that have the most influence on the IPv6 address activity score, which helps to improve the accuracy and efficiency of the multi-dimensional scoring model. The model training after feature selection can focus more on important features and reduce the computational overhead.

[0107] As a possible implementation manner of this embodiment, the loss function of the multi-dimensional scoring model adopts the mean square error loss function.

[0108] As a possible implementation manner of this embodiment, step 5 includes the following steps:

[0109] Sort all the IPv6 addresses obtained in step 4 in descending order according to their scores:

[0110] Sorted Addresses= sort(IPv6 Addresses , key = Score, order = desc);

[0111] Where: Sorted Addresses represents the sorted list of IPv6 addresses; IPv6 Addresses represents the set of all IPv6 addresses; Score represents the score of each address; sort represents the sorting function; key represents the keyword used for sorting; order = desc indicates that the sorting order is descending;

[0112] Divide the sorted IPv6 addresses into several address segments, each address segment contains a group of similar addresses, and use fixed-size address segments for division:

[0113] Address Segments = {Sorted Addresses [i:i + K] | i = 0, K, 2K,..., N - K};

[0114] Where: Address Segments represents the set of address segments after division; Sorted Addresses [i:i + K] represents the consecutive k addresses starting from index i in the sorted address list; i represents the starting index of the current address segment, taking values 0, K, 2K,..., N - K in sequence; K represents the number of addresses contained in each address segment; N represents the total number of sorted IPv6 addresses;

[0115] Calculate the average score of each address segment as the score of this address segment:

[0116]

[0117] Where: Segment_Score j represents the average score of the j-th address segment; Score (j-1)K+i represents the score of the i-th address in the j-th address segment, and the index starts from (j - 1)K + i;

[0118] Sort all address segments in descending order according to the scores of the address segments to determine the scanning priority of each address segment.

[0119] Exemplary:

[0120] Suppose we have the following IPv6 addresses and their scores:

[0121] {Addr1: 0.95, Addr2: 0.90, Addr3: 0.85, Addr4: 0.80, Addr5: 0.75, Addr6: 0.70}

[0122] Sorted Addresses:

[0123] Sorted_Addresses = [Addr1, Addr2, Addr3, Addr4, Addr5, Addr6]

[0124] Divide address segments:

[0125] If each address segment contains K = 2 addresses:

[0126] Address_Segments = [[Addr1, Addr2], [Addr3, Addr4], [Addr5, Addr6]]

[0127] Calculate address segment scores:

[0128] Segment_Score_1 = (0.95 + 0.90) / 2 = 0.925

[0129] Segment_Score_2 = (0.85 + 0.80) / 2 = 0.825

[0130] SegmentScore_3 = (0.75 + 0.70) / 2 = 0.725

[0131] Determine the scanning priority:

[0132] Sorted_Segments = [[Addr1, Addr2], [Addr3, Addr4], [Addr5, Addr6]]

[0133] In this embodiment, the IPv6 addresses are sorted in descending order of scores and divided into several address segments. Each address segment contains a group of similar addresses, which helps to improve the scanning efficiency. By preferentially scanning the address segments with high scores, more active addresses can be quickly discovered; the scanning priority is determined according to the scores of the address segments, ensuring that the limited scanning resources are used in the areas most likely to discover active addresses, thus optimizing the resource utilization rate.

[0134] As a possible implementation manner of this embodiment, step 6 includes the following steps:

[0135] Allocate scanning tasks: Allocate the address segments with high priorities determined in step 5 to multiple scanners for parallel scanning;

[0136] Start parallel scanning: Each scanner simultaneously starts scanning the allocated address segments and records the scanning results;

[0137] Collect scanning feedback: Collect the real-time scanning feedback of each scanner, including scanning success rate and response time metrics;

[0138] Adjust the scanning order: Adjust the scanning order according to the scanning feedback, and give priority to scanning the address segments with high success rate and short response time:

[0139]

[0140] Where: Priority i represents the priority of the i-th address segment; f represents the function for adjusting the priority according to the feedback;

[0141] Redivide the address segments: Redivide the address segments according to the adjusted priority to ensure that the high-priority address segments receive more scanning resources;

[0142] Record the scanning logs: Record the logs of each scan, including the scan time, scanner ID, scanned address segment and its result;

[0143] Collect training data: Extract the latest scan results from the database as the training data for the multi-dimensional scoring model;

[0144] Update the multi-dimensional scoring model: Retrain the multi-dimensional scoring model and optimize the model parameters using the latest training data;

[0145] Replace the old model: Replace the old multi-dimensional scoring model with the updated one.

[0146] The above are only the preferred embodiments of the present application, and are not intended to limit the present application. Any modifications, equivalent replacements, and improvements made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for improving IPv6 address scanning efficiency based on a multi-dimensional scoring model, characterized in that: The following steps are involved: Step 1: Obtain known active addresses from the existing IPv6 address database, collect BGP routing information, DNS logs, and passive traffic detection data, and clean and deduplicate the data to obtain multi-dimensional data related to IPv6 addresses; Step 2: Based on the obtained multi-dimensional data related to the IPv6 addresses, classify the IPv6 addresses according to the ISP; Step 3: Extract features related to activity based on the classification results, and calculate the proximity features of each address to obtain activity features and proximity features; Step 4: Build a multidimensional scoring model based on random forest, perform feature selection on the obtained multidimensional data, classification results, proximity features, and active features related to the IPv6 address, and use the features obtained after feature selection as the input of the multidimensional scoring model to obtain the score of each IPv6 address; Step 5: Sort all IPv6 addresses in descending order according to their scores, divide the addresses into several address segments, each of which contains a group of similar addresses, and determine the scanning priority based on the scores of the address segments; Step 6: Use parallel scanning technology to scan address segments with high scores first, adjust the scanning order and address segment division according to real-time feedback, record the scanning results, update the model training data, and continuously optimize the multi-dimensional scoring model.

2. The method for improving IPv6 address scanning efficiency based on a multidimensional scoring model according to claim 1, characterized in that: The step 2 comprises the following steps: Extract IPS information: Extract the IPv6 address prefix and the corresponding autonomous system information from the BGP routing information, and use the mapping table between the autonomous system number and the IPS to determine the ISP to which each IPv6 address belongs; Classification: According to the IPS information, each IPv6 address is labeled with a corresponding ISP label, and the IPv6 addresses are grouped according to the ISP label; Data storage: Store the classified IPv6 addresses and their corresponding IPS tags in a structured data format.

3. The method for improving IPv6 address scanning efficiency based on a multidimensional scoring model according to claim 1, characterized in that: The activity feature extraction comprises the following steps: Query frequency: count the number of queries for each IPv6 address in the DNS log: Where: QF i represents the query frequency of the i-th IPv6 address; N dns (i) represents the number of DNS queries for the i-th IPv6 address in time period T; T represents the specified time period; Traffic frequency: Counts the number of times each IPv6 address appears in passive traffic detection: Where: TF i represents the traffic frequency of the i-th IPv6 address; N traffic (i) represents the number of traffic occurrences of the i-th IPv6 address in time period T.

4. The method for improving IPv6 address scanning efficiency based on a multidimensional scoring model according to claim 1, characterized in that: The calculation of the proximity feature comprises the following steps: Data preparation: Select address data within the unified ISP group from the classification results of IPv6 addresses and calculate the proximity characteristics of each address; Proximity feature calculation: Based on the prefix of the IPv6 address, the distance between each address and its nearest neighbor is calculated: Where: DW i represents the distance weight of the ith IPv6 address; Neighbors(i) represents the set of neighbor addresses that belong to the same ISP group as the ith IPv6 address; dist(i,j) represents the distance between the ith IPv6 address and the jth IPv6 address; |Neighbors(i)| represents the number of neighbor address sets; ∈ is used to prevent division by zero and its value is 10 -6 ; Where: bit ik Indicates the kth binary bit of the i-th IPv6 address; bit jk Represents the kth binary bit of the jth IPv6 address; k represents the position of the binary bit, from 1 to 128.

5. The method for improving IPv6 address scanning efficiency based on a multidimensional scoring model according to claim 1, characterized in that: The step 4 comprises the following steps: Feature selection: Use the random forest algorithm to select features and determine the features that have the greatest impact on the IPv6 address activity score; Where: Importance(f) represents the importance of feature f; n trees Indicates the number of trees in the random forest; ImpurutyDecrease t (f) indicates the reduction of impurity of feature f in the tth lesson tree; According to the results of feature selection, the most important features are selected to build the final multi-dimensional scoring model; the multi-dimensional scoring model is trained again using the random forest algorithm, with the input being the most important features selected, and the data output being the score of each IPv6 address; Calculate the score: Use the trained multi-dimensional scoring model to calculate the score of each IPv6 address, and store the score of each IPv6 address in a result set. The format of the result set includes: IPv6 address, score, and each feature value used to calculate the score.

6. The method for improving the IPv6 address scanning efficiency of the multi-dimensional scoring model according to claim 5, characterized in that: The loss function of the multidimensional scoring model adopts a mean square error loss function.

7. The method for improving the IPv6 address scanning efficiency of the multi-dimensional scoring model according to claim 1, characterized in that: The step 5 comprises the following steps: Sort all IPv6 addresses obtained in step 4 in descending order according to their scores: Sorted Addresses =sort(IPv6 Addresses ,key=Score,order=desc); Where: Sorted Addresses Represents a sorted list of IPv6 addresses; IPv6 Addresses Represents the set of all IPv6 addresses; Score represents the score of each address; sort represents the sorting function; key represents the keyword used for sorting; order=desc represents the sorting order is descending; The sorted IPv6 addresses are divided into several address segments. Each address segment contains a group of similar addresses. The address segments are divided into fixed-size segments: Address Segments ={Sorted Addresses [i:i+K]|i=0,K,2K,…,N-K}; Where: Address Segments Indicates the set of divided address segments; Sorted Addresses [i:i+K] indicates the consecutive k addresses with starting index i in the sorted address list; i indicates the starting index of the current address segment, which is 0, K, 2K, …, NK in sequence; K indicates the number of addresses contained in each address segment; N indicates the total number of IPv6 addresses after sorting; Calculate the average score of each address segment as the score of the address segment: Where: Segment_Score j Score represents the average score of the jth address segment; (j-1)K+i Indicates the score of the i-th address in the j-th address segment, and the microcosm starts from (j-1)K+i; All address segments are sorted in descending order according to their scores to determine the scanning priority of each address segment.

8. The method for improving the IPv6 address scanning efficiency of the multi-dimensional scoring model according to claim 1, characterized in that: The step 6 comprises the following steps: Allocate scanning tasks: allocate the high-priority address segments determined in step 5 to multiple scanners for parallel scanning; Start parallel scanning: Each scanner starts scanning the assigned address segment at the same time and records the scanning results; Collect scanning feedback: Collect real-time scanning feedback from each scanner, including scanning success rate and response time indicators; Adjust the scanning order: adjust the scanning order according to the scanning feedback, and give priority to the address segments with high scanning success rate and response time period: Where: Priority i represents the priority of the ith address segment; f represents the function for adjusting the priority according to feedback; Re-dividing address segments: Re-dividing address segments according to the adjusted priorities to ensure that high-priority address segments get more scanning resources; Record scan logs: record the logs of each scan, including scan time, scanner ID, scanned address segment and its results; Collect training data: extract the latest scan results from the database as training data for the multidimensional scoring model; Update the multidimensional scoring model: retrain the multidimensional scoring model and optimize the model parameters using the latest training data; Replace old model: Replace the old multidimensional scoring model with the updated multidimensional scoring model.

Images