IPv6 target address generation method and system based on address space forest

Abstract

The invention discloses an IPv6 target address generation method and system based on an address space forest, and the method comprises the steps: constructing a plurality of IPv6 address space trees for collected IPv6 seed addresses according to a preposed DHC clustering segmentation strategy, and forming an IPv6 address space forest; filtering out low-dimension nodes of different IPv6 address space trees, merging address modes corresponding to the low-dimension nodes, and then generating an IPv6 target address of a low-dimension mode space; and filtering out the IPv6 target addresses which are not alias from the IPv6 target addresses in the low-dimension mode space, scanning the IPv6 target addresses which are not alias, and collecting the detected IPv6 active addresses. According to the method, the IPv6 address space forest is constructed, and high-activity address areas in the loss mode space and the high-dimension mode space are converted into a low-dimension mode, so that the number of IPv6 active addresses predicted by an algorithm is increased.

Description

Technical Field

[0001] The present invention relates to the technical field of computer networks, and in particular, to an IPv6 target address generation method and system based on an address space forest. Background Art

[0002] The next-generation Internet Protocol IPv6 (Internet Protocol version 6) has entered a rapid development stage globally. As of February 2025, the IPv6 support rate in 40 countries around the world exceeds 40%.

[0003] Efficient Internet-scale IPv6 address scanning is a key technology for IPv6 asset discovery and cyberspace mapping. Due to the extremely large IPv6 address space and the particularly sparse distribution of active addresses, the efficiency of detecting Internet-scale IPv6 live addresses is very low. Under the condition of a gigabit network card, the asynchronous scanning tool ZMap can complete the full address space scanning of IPv4 (Internet Protocol version 4) within 45 minutes. However, using such a traversal address scanning method, it takes tens of millions of years to scan the entire IPv6 address space.

[0004] In response to the challenge of rapid IPv6 address scanning brought about by the huge IPv6 address space, IPv6 target address generation (also known as IPv6 address prediction) has gradually become a research hotspot. By learning the information of a known IPv6 seed address set (live or previously live IPv6 addresses), high-activity IPv6 target addresses (predicted address sets) are generated to narrow the IPv6 address detection space and quickly discover IPv6 active addresses.

[0005] However, the number of IPv6 active addresses predicted by existing IPv6 target address generation algorithms is limited. Existing IPv6 target address generation algorithms are mostly limited to the low-dimensional mode (mode dimension ≤ 4) space generated by the IPv6 address space tree. Due to the imbalance of IPv6 seed addresses and the irreversibility of clustering in the IPv6 target address generation algorithm, the low-dimensional modes in a single IPv6 address space tree of algorithms such as 6Scan and 6Tree or two IPv6 address space trees of the HMap6 algorithm are limited, while the huge loss mode space and high-dimensional mode space have problems of being unable to be detected and having too large a detection space respectively. The space of existing IPv6 target address generation algorithms for predicting IPv6 active addresses is limited, so the number of predicted IPv6 active addresses is limited.

[0006] According to the differences in the technology of learning the IPv6 seed address set, existing IPv6 target address generation algorithms can be mainly divided into IPv6 target address generation algorithms based on machine learning and traditional clustering.

[0007] (1) Machine Learning-based IPv6 Target Address Generation Algorithm

[0008] The machine learning-based IPv6 target address generation algorithm mines the potential rules within the IPv6 seed address set by applying machine learning algorithms or ideas, aiming to increase the number of active IPv6 addresses under the same budget. Such algorithms mainly include 6GCVAE, 6VecLM, 6GAN, and 6SENSE.

[0009] 6GCVAE uses an encoder composed of stacked gated convolutional layers to learn the semantic information of IPv6 addresses, reconstructs a 32-dimensional IPv6 address vector through a decoder, and finally uses the trained decoder as an IPv6 target address generator to generate IPv6 target addresses.

[0010] 6VecLM uses word embedding and language modeling to guide the generation of IPv6 target addresses, which is a specific implementation of the text generation problem in the field of IPv6 target address generation. First, 6VecLM maps IPv6 addresses to a vector space, where the dimension value and position of the IPv6 address serve as a word vector, and the entire IPv6 address serves as a sentence. Next, 6VecLM uses a Transformer network to establish an IPv6 language model to predict the IPv6 address sequence.

[0011] 6GAN applies the ideas of adversarial learning and reinforcement learning to the generation of IPv6 target addresses. 6GAN first divides the IPv6 seed addresses into k addressing modes, and then k generators simulate the k addressing modes through adversarial training with a discriminator, where the address sequence decision of the generator is determined by the rewards from the discriminator and the alias detector.

[0012] 6SENSE divides the IPv6 address into three parts: IPv6 prefix (Prefix), SID (Subnet IDentifier), and the lower 64-bit IID (Interface IDentifier), and divides the steps of generating IPv6 target addresses into three steps.

[0013] In the first step, 6SENSE applies Explore-Exploit reinforcement learning to prefix generation, allocating equal budgets in each prefix to expand the breadth of IPv6 address exploration, and weighting the budgets of different prefixes according to the hit rate to increase the depth of active prefixes. In the second step, 6SENSE learns the semantic information of the prefix through an LSTM model and generates the SID, while improving the algorithm speed through parallel operations. In the third step, 6SENSE generates the IID using three strategies: high-frequency IID mode, high-response IID (::1), and iteration.

[0014] Although these algorithms improve the hit rate of IPv6 target address generation, there are the following problems:

[0015] 1) The algorithm model training is time-consuming. The machine learning algorithms used by these algorithms are complex and the model training time is long.

[0016] 2) Only suitable for small-scale IPv6 seed addresses. The high complexity of machine learning algorithms makes such algorithms can only process small-scale IPv6 seed address sets, so the predicted IPv6 active address space is limited and the number of generated IPv6 active addresses is small.

[0017] In order to predict as many IPv6 active addresses as possible in a short time, the present invention does not adopt machine learning technology, but uses traditional clustering technology to learn the seed address set and predict IPv6 active addresses based on this.

[0018] (2) IPv6 target address generation algorithm based on traditional clustering

[0019] The IPv6 target address generation algorithm based on traditional clustering performs vertical analysis on IPv6 addresses, guided by the address entropy theory, to explore the distribution law of the IPv6 address set in the IPv6 address dimension. Such algorithms usually use clustering methods to construct an IPv6 address space tree, and then detect in the node pattern space divided by the space tree to obtain IPv6 active addresses. Such algorithms include 6Gen, 6Tree, DET, 6Scan, 6Forest, and HMap6.

[0020] However, the unbalanced IPv6 seed address set results in limited low-dimensional patterns (pattern dimension ≤ 4) in the IPv6 address space tree, and most of the IPv6 space is occupied by loss patterns (patterns that do not contain IPv6 seed addresses) and high-dimensional patterns, so the space available for IPv6 address generation is limited. The IPv6 Address Space Tree (6ASTree) is a data structure formed by dividing IPv6 seed addresses. Figure 1 The light grayish-white nodes and green nodes together form the IPv6 address space tree. The pattern dimension is the number of '*' in the pattern. For example, the pattern dimension of node 1 is 3.

[0021] Figure 1 As an example of the existing algorithm for generating IPv6 address patterns based on seed addresses, it shows that algorithms such as 6Scan generate IPv6 address patterns by constructing an IPv6 address space tree. Figure 1It includes 2 low-dimensional nodes (nodes 33 - 34), 2 high-dimensional nodes (nodes 1, 17) and 42 loss pattern nodes (nodes 3 - 16, nodes 19 - 32, nodes 35 - 48). Taking typical algorithms such as 6Scan, 6Tree, and 6Hit as examples, the challenges brought by loss patterns and high-dimensional patterns to IPv6 address detection are elaborated. 6Scan constructs an IPv6 address space tree by splitting the leftmost variable dimension, and only generates 2 low-dimensional patterns (node33, node34). The detectable IPv6 address space is only 0.04% of the root node, that is, the area for IPv6 address generation is limited.

[0022] This phenomenon brings two challenges:

[0023] 1) It is impossible to detect the highly active regions in the loss pattern space. There is a huge loss space in the IPv6 address space tree, and the loss space will be discarded when constructing the IPv6 address space tree. Figure 1 Among them, the loss pattern space accounts for 93.22% of the root node space size.

[0024] 2) Detecting the highly active regions in high-dimensional patterns is costly. The IPv6 address detection space of the seed pattern is related to the pattern dimension. To detect all seed patterns, it is necessary to detect a pattern space that grows exponentially with the increase of the dimension. Detecting node33 only requires detecting 14 IPv6 target addresses (subtracting 2 seed addresses), while detecting node1 requires detecting 4094 addresses. In actual experiments, the scale of a pattern space with a dimension of 27 is on the order of 10 33 . Summary of the Invention

[0025] To address the problem that the existing IPv6 target address generation algorithms have a limited prediction of the number of IPv6 active addresses, a method and system for generating IPv6 target addresses based on an address space forest are proposed. By constructing an IPv6 address space forest, the highly active regions in high-dimensional patterns and loss pattern spaces are identified to increase the number of IPv6 active addresses.

[0026] To achieve the above objective, the present invention adopts the following technical solutions:

[0027] On the one hand, the present invention proposes a method for generating IPv6 target addresses based on an address space forest, including:

[0028] Constructing multiple IPv6 address space trees based on the collected IPv6 seed addresses according to the pre-set DHC clustering segmentation strategy to form an IPv6 address space forest;

[0029] Filter out the low-dimensional nodes of different IPv6 address space trees, merge the address patterns corresponding to the low-dimensional nodes, and then generate the IPv6 target addresses in the low-dimensional pattern space; a node represents an IPv6 address pattern, and an IPv6 address pattern represents all IPv6 addresses belonging to that pattern.

[0030] Filter out the non-alias IPv6 target addresses from the IPv6 target addresses in the low-dimensional pattern space, scan the non-alias IPv6 target addresses and collect the detected IPv6 active addresses.

[0031] Furthermore, construct the IPv6 address space forest in the following manner:

[0032] Initialize the root node according to the IPv6 seed address, construct multiple DHC variable-dimensional segmentation arrays in a random manner, and sequentially split the variable dimensions in the address pattern according to the DHC clustering segmentation order from right to left until the number of IPv6 seed addresses in the node is lower than the threshold or the pattern dimension of the node is lower than the threshold, thereby constructing multiple IPv6 address space trees and forming an IPv6 address space forest.

[0033] Furthermore, when there are sufficient IPv6 seed addresses, the total number of nodes in the i-th layer of the IPv6 address space tree is 16 i-1 .

[0034] Furthermore, when the number of IPv6 seed addresses is small and unevenly distributed, there is a unique address space among the address patterns of the IPv6 address space trees constructed by different DHC clustering segmentation strategies.

[0035] Furthermore, the number of IPv6 addresses contained in the node decreases exponentially as the level of the node in the IPv6 address space tree increases.

[0036] Furthermore, the pattern dimension of the low-dimensional pattern is lower than 4.

[0037] Furthermore, the preposed DHC clustering segmentation strategy includes a DHC variable-dimensional segmentation array and a DHC clustering segmentation order; the index position of the variable dimension for each DHC clustering segmentation is determined by the DHC clustering segmentation order, the layer number of the node in the space tree, and the DHC variable-dimensional segmentation array.

[0038] Furthermore, the detected IPv6 active addresses are represented by the following formula:

[0039]

[0040] Where A is the active address space in the entire IPv6 address space, m represents the number of additional constructed IPv6 address space trees, r[i] represents the number of low-dimensional address patterns existing in the i-th IPv6 address space tree, and S ij represents the IPv6 address space of the j-th node in the i-th IPv6 address space tree, Q[a] represents the loss pattern space discarded by the a-th IPv6 address space tree, 0 ≤ a ≤ m, 0 ≤ c ≤ m, 1 ≤ d ≤ r[c], (r[a] + 1) ≤ e ≤ q[a], and q[a] represents the number of patterns existing in the a-th IPv6 address space tree. represents that there is an intersection between the loss pattern space of the a-th IPv6 address space tree and the low-dimensional pattern space of the c-th IPv6 address space tree. represents that there is an intersection between the high-dimensional node pattern space of the a-th IPv6 address space tree and the low-dimensional pattern space of the c-th IPv6 address space tree. represents that both the loss pattern space and the high-dimensional pattern space of the a-th IPv6 address space tree have intersections with the low-dimensional pattern space of the c-th IPv6 address space tree.

[0041] On the other hand, the present invention proposes an IPv6 target address generation system based on an address space forest, including:

[0042] An IPv6 address space forest construction module for constructing multiple IPv6 address space trees based on the collected IPv6 seed addresses according to the pre-set DHC clustering segmentation strategy to form an IPv6 address space forest.

[0043] A pattern mining module for filtering out the low-dimensional nodes of different IPv6 address space trees, merging the address patterns corresponding to the low-dimensional nodes, and then generating IPv6 target addresses in the low-dimensional pattern space; a node represents an IPv6 address pattern, and an IPv6 address pattern represents all IPv6 addresses belonging to this pattern.

[0044] A detection module for filtering out non-aliased IPv6 target addresses from the IPv6 target addresses in the low-dimensional pattern space, scanning the non-aliased IPv6 target addresses, and collecting the detected IPv6 active addresses.

[0045] Compared with the prior art, the present invention has the following beneficial effects:

[0046] Aiming at the problem of the small number of predicted active addresses in the existing IPv6 target address generation algorithm, the present invention proposes an IPv6 address space forest technology. By constructing an IPv6 address space forest, more IPv6 address patterns are generated, the prediction space is expanded, so as to increase the number of predicted IPv6 active addresses.

[0047] Aiming at the problems that the loss mode space cannot be detected and the detection cost of the active region in the high-dimensional mode space is high, the present invention designs and implements a preposed DHC clustering and segmentation strategy. By constructing multiple IPv6 address space trees, the high-active regions in the loss mode space and the high-dimensional mode space are transformed into low-dimensional modes, thereby increasing the number of IPv6 active addresses predicted by the algorithm. By separating the core elements of the DHC clustering technology into two core elements, namely the DHC variable-dimension segmentation array and the DHC clustering and segmentation order, the process of constructing the IPv6 address space tree is made controllable. Description of the Drawings

[0048] Figure 1 An example of the existing algorithm in the background technology for generating IPv6 address patterns based on seed addresses;

[0049] Figure 2 A flowchart showing a method for generating an IPv6 target address based on an address space forest provided by an embodiment of the present invention;

[0050] Figure 3 Definition of a node (pattern) provided by an embodiment of the present invention;

[0051] Figure 4 Influence of two factors of DHC clustering on constructing an IPv6 address space tree provided by an embodiment of the present invention;

[0052] Figure 5 Logical schematic of RigtVDPS and LeftVDPS provided by an embodiment of the present invention;

[0053] Figure 6 An example of generating an IPv6 address pattern based on a seed address provided by an embodiment of the present invention;

[0054] Figure 7 Result comparison between an IPv6 address space tree and an IPv6 address space forest provided by an embodiment of the present invention;

[0055] Figure 8 Performance of different IPv6 target address generation algorithms on a balanced seed set provided by an embodiment of the present invention;

[0056] Figure 9 Performance of different IPv6 target address generation algorithms in terms of the number of active addresses & hit rate under the same budget provided by an embodiment of the present invention;

[0057] Figure 10 Active addresses and DHC preferred segmentation dimensions provided by an embodiment of the present invention;

[0058] Figure 11 Relationship between active addresses and the number of IPv6 address space trees provided by an embodiment of the present invention. Detailed implementation manners

[0059] For the convenience of understanding, the following explanations are made for some terms appearing in the detailed implementation manners of the present invention:

[0060] IPv6 address vector: A 128-bit IPv6 address can be converted into a 32-dimensional half-byte IPv6 address vector. The value range of each half-byte is [0 - f].

[0061] Fixed dimension / free dimension: In the IPv6 address vector, the fixed dimension takes a fixed value, and the free dimension is represented by the wildcard "*". Figure 1 The 31st dimension of the middle node 33 is a free dimension, and the remaining 0 - 30 dimensions are fixed dimensions.

[0062] Pattern dimension: The pattern dimension, also known as the variable dimension or dimension, refers to the number of variable dimensions in the IPv6 address pattern, represented by £.

[0063] Pattern space / address space: The size of the pattern space of an IPv6 address pattern with a pattern dimension of £ is 16 ￡ , which can represent 16 ￡ IPv6 addresses.

[0064] IPv6 address pattern: An IPv6 address vector with variable dimensions. An IPv6 address pattern represents all IPv6 addresses belonging to that pattern. For example, the IPv6 address pattern of the entire IPv6 address space is "****:****:****:****:****:****:****:****". Figure 1 In the case of node 33, the IPv6 address pattern is "2001::110*", and the range of IPv6 addresses belonging to this pattern is 2001::1100 - 2001:110f.

[0065] Loss node / loss pattern: If the number of IPv6 addresses contained in a node in the IPv6 address space tree is less than 2, then this node is a loss node. The pattern of the loss node is a loss pattern.

[0066] Hierarchical Clustering: Hierarchical Clustering is a clustering algorithm used to group data points into a tree-like cluster with a hierarchical structure. This method can be divided into two main forms:

[0067] Divisive Hierarchical Clustering (DHC): The divisive method starts by placing all data points in a single cluster ( Figure 1 in the root node), and then gradually splits the cluster into smaller clusters (Figure 1 the intermediate node or leaf node of the tree), until a certain termination condition is reached (the termination condition in Algorithm 1 is that the pattern dimension of the node is less than or equal to 2 or the number of IPv6 addresses contained in the node is less than 12).

[0068] Agglomerative Hierarchical Clustering (AHC): This method initially treats each data point as an independent cluster, and then gradually merges the most similar clusters until all data points are merged into one cluster or a certain termination condition is reached.

[0069] IPv6 Address Space Tree (6ASTree): The tree-like structure formed by the IPv6 address generation algorithm through hierarchical clustering is the IPv6 address space tree. Multiple IPv6 address space trees form the IPv6 address space forest (6ASForest).

[0070] Two key types of DHC clustering: Two key elements, DHC clustering segmentation array and DHC clustering segmentation order, control DHC clustering to construct the IPv6 address space tree in a specific direction.

[0071] Alias prefix: It means that all addresses within an IPv6 prefix point to the same device.

[0072] The present invention will be further explained below in conjunction with the accompanying drawings and specific embodiments:

[0073] a) Design idea

[0074] Core Observation 1: Addresses in the low-dimensional address pattern space have a high probability of being active addresses. According to the prior knowledge of density, it is known that the address pattern with a high density of seed addresses is an active pattern and the addresses in this address pattern are likely to be active addresses. Due to the huge exponentially growing space, and the number of seed addresses is similar to that of low-dimensional address patterns, the density of seed addresses in high-dimensional address patterns is low, and the activity is lower compared to low-dimensional address patterns. Therefore, the present invention preferentially generates IPv6 target addresses in the low-dimensional address pattern space. Table 1 tests the relationship between patterns of different pattern dimensions and the hit rate on a seed address set of 10,ooo scale. It can be seen from the experiment that the addresses in patterns with a pattern dimension less than 4 have a high probability of being IPv6 active addresses. Therefore, the present invention sets the threshold of the low-dimensional pattern to 4.

[0075] Table 1 Relationship between patterns of different dimensions and hit rate

[0076] Pattern Dimension Pattern Quantity Hit Rate Pattern Dimension Pattern Quantity Hit Rate 1 6 86.46％ 2 46 59.88％ 3 267 30.14％ 4 329 31.47％ 5 174 4.53％ 6 116 2.22％

[0077] Core Observation 2: There is a unique address space among different IPv6 address space tree address patterns. When the number of seed addresses is small and the distribution is uneven, there is a unique address space among the address patterns of IPv6 address space trees constructed by different DHC clustering strategies. By constructing multiple IPv6 address space trees, high-dimensional patterns and highly active regions in the loss pattern space can be identified, and IPv6 active addresses can be predicted in these regions.

[0078] Through the above observations, it is found that we can construct multiple IPv6 address space trees through different DHC clustering strategies, and mine the highly active regions in the high-dimensional address pattern space and the loss pattern space in a single IPv6 address space tree (based on the seed addresses) to obtain a larger number of low-dimensional address patterns, thereby predicting a larger number of IPv6 active addresses.

[0079] Based on the above key observations, the present invention designs an IPv6 target address generation method based on an address space forest (abbreviated as 6Probe), as Figure 2 shown, which includes a total of 3 stages:

[0080] The first step is the IPv6 address space forest construction stage. Multiple IPv6 address space trees are constructed for the collected IPv6 seed addresses according to the pre-set DHC clustering segmentation strategy to form an IPv6 address space forest. This step is the key step for the method of the present invention to detect more active addresses than the IPv6 target address generation algorithm that only performs DHC clustering once.

[0081] The second step is the pattern mining stage. Filter out the low-dimensional (node dimension ≤ 4) nodes of different IPv6 address space trees, merge the patterns corresponding to the low-dimensional nodes, and then generate the IPv6 target addresses in the low-dimensional pattern space. A node represents an IPv6 address pattern, and an IPv6 address pattern represents all IPv6 addresses belonging to this pattern. The definition of a node (pattern) is as Figure 3 shown.

[0082] The third step is the detection stage. According to the known IPv6 alias prefixes, filter out the non-aliased IPv6 target addresses from the IPv6 target addresses in the low-dimensional pattern space, and finally scan these addresses and collect the detected IPv6 active addresses. As an implementable manner, the IPv6 alias prefixes published by Gasser et al. [https: / / alcatraz.net.in.tum.de / ipv6-hitlist-service / open / aliased-prefixes.txt.xz] can be used.

[0083] Furthermore, the IPv6 address space forest is constructed in the following manner:

[0084] Initialize the root node according to the IPv6 seed address, construct multiple DHC variable - dimension split arrays in a random manner, and split the variable dimensions in the split mode in the DHC clustering split order from right to left until the number of IPv6 seed addresses in the node is lower than the threshold or the mode dimension of the node is lower than the threshold, thereby constructing multiple IPv6 address - space trees and forming an IPv6 address - space forest.

[0085] b) Construction of IPv6 address - space forest

[0086] This subsection first describes the algorithm for constructing the IPv6 address - space forest 6ASForest, then proves the conditions required for different 6ASForests to contain unique addresses, and finally derives the maximum number of 6ASForests that a 6ASForest can contain.

[0087] ⅰ. Algorithm for IPv6 address - space forest

[0088] Algorithm 1 shows the main logic for constructing the IPv6 address - space forest. First, initialize the root node according to the IPv6 seed address. Next, construct the (m + 1) - dimensional DHC variable - dimension split array SplitArray[m]. Then, construct the IPv6 address - space forest (including 1 initial IPv6 address - space tree and m additional constructed IPv6 address - space trees) according to the DHC clustering split order SplitOrder loop. Finally, return the list of low - dimension nodes of the (m + 1) IPv6 address - space trees for generating detectable IPv6 target addresses.

[0089]

[0090]

[0091] The pre - placed DHC clustering split strategy includes two key elements: the DHC variable - dimension split array SplitArray and the DHC clustering split order SplitOrder.

[0092] In the DHC clustering function, the termination condition adds a dimension threshold D1 (D1 is generally less than or equal to 2) based on the threshold of the number of seed addresses in the node, so that more IPv6 active addresses can be detected under an acceptable detection cost. The index position SplitIndex of the variable dimension for each DHC clustering split is determined by the DHC clustering split order SplitOrder, the layer number of the node in the space tree, and the DHC variable dimension split array SplitArray, ensuring that the IPv6 address space tree is constructed in the order of the DHC variable dimension split array. The SplitVecs function is called to split the current node on the variable dimension at the index position SplitIndex, generating a subset of the seed address set. Then, child nodes are created based on these subsets, and the DHC clustering function is called to repeat the above steps until the number of seed addresses or the dimension is lower than the threshold.

[0093] When constructing the IPv6 address space tree, the DHC clustering split order SplitOrder controls the direction of splitting the variable dimension, and the DHC variable dimension split array SplitArray controls the specific position of splitting the variable dimension. The values of SplitOrder include "Left" and "Right", representing splitting the variable dimension of the node in the order from left to right or from right to left, respectively. The value of the DHC variable dimension split array SplitArray[m][i]=j means that when constructing the m-th IPv6 address space tree, the i-th node splits the j-th variable dimension of this node.

[0094] More details about the DHC clustering split order and the DHC variable dimension split array will be elaborated in Section V.c).

[0095] ⅱ. Conditions for the IPv6 address space tree to contain unique addresses

[0096] Theorem 1. When there are sufficient seed addresses, the total number of nodes in the i-th layer of the IPv6 address space tree is 16 i-1 .

[0097] Proof. The process of constructing the IPv6 address space tree by DHC clustering is the process of constructing a complete 16-ary tree. Each node splits a certain variable dimension, specifically with 16 values from [0-f], that is, each node contains 16 adjacent child nodes. There is only the root node in the first layer, that is, the number of nodes in the first layer can be expressed as 16 0 . The nodes in the second layer are the adjacent child nodes of the root node, with a total of 16 nodes, that is, the number of nodes in the second layer can be expressed as 16 1 . And so on, the number of nodes in the i-th layer is 16 i-1 .

[0098] Theorem 2. When the distribution of IPv6 address quantities is unbalanced, there are a large number of loss patterns in different IPv6 address space trees.

[0099] Proof. Let the total quantity of IPv6 active address sets be N0, and the root node has m dimensions that need to be split (specifically), and each dimension has 16 possible values (0 - f), p d is the probability of the data in the d-th dimension taking a specific value (for ease of calculation, set p d to be uniform, 1 / 16), and splitting is performed in the order of the variable dimension subscript array {d0, d1, …, d m-1}}. For node v, at the k-th split (the child nodes of node v), the data volume of this node is where can be calculated using the following formula:

[0100]

[0101] If a node is a loss node, then the number of IPv6 addresses contained in this node is lower than the threshold, that is (where the value of T is 2). The number of seeds in the existing IPv6 address prediction algorithm seed sets is mostly less than 1 million. Let N0 = 10 6 ≈2 20 . Then the condition for node v to be a loss node can be expressed by the following formula:

[0102]

[0103] Solving gives k ≥ 5.75. This means that if the layer where node v is located in the IPv6 address space tree is greater than or equal to 6 layers, this node is more likely to be a loss node. When algorithms such as 6Probe and 6Scan construct the IPv6 address space tree, the dimension of the root node is D root = 32, and the node pattern of low-dimensional nodes is less than or equal to the threshold D1 = 4. The layer of low-dimensional nodes in the IPv6 address space tree is at least (D root - D1 + 1)= 29 ≥ 6. From the formula, it can be seen that the number of IPv6 addresses contained in a node decreases exponentially as the layer where it is located in the IPv6 address space tree increases. Therefore, most of the nodes in the IPv6 address space tree constructed by algorithms such as 6Probe and 6Scan are loss nodes, that is, there are a large number of loss patterns in the IPv6 address space tree.

[0104] Theorem 3. The condition for the IPv6 address space tree to have a unique target address is that there are loss patterns in the remaining IPv6 address space trees.

[0105]

[0106] Proof. If the IPv6 seed set is C and the dimension of the node is £, then the node has £ splitting strategies in total. The child node pattern generated according to the i-th variable dimension can be expressed as A i[j] (0 ≤ j ≤ f), that is, the values of all seed addresses in this child node at the i-th dimension are j. If there is an intersection between the pattern space and the seed set, then this pattern is a node pattern or a seed pattern; otherwise, it is a loss pattern. As shown in the above formula, if there is a loss pattern A i[k] in the i-th IPv6 address space tree, and there is a node pattern A j[l] in the j-th IPv6 address space tree, and they have a common sub-pattern A i[k]j[l] . When detecting the addresses in the probe pattern A j[l] space, some addresses of the loss pattern A i[k] will be detected simultaneously. Then, as long as there are loss patterns in the patterns generated according to different strategies, the IPv6 address space trees formed according to different splitting strategies can cover unique IPv6 target addresses.

[0107] ⅲ. The maximum number of space trees that the IPv6 address space forest can contain

[0108] Assume that the dimension of all leaf nodes is d, and there is a sufficient and evenly distributed set of IPv6 seed addresses. Then the height of the constructed IPv6 address space tree is 32 - d, and there are 31 - d layers of nodes that split during DHC clustering. This is equivalent to selecting 31 - d nibble dimensions from 31 nibble dimensions to participate in DHC clustering, and a total of A(31, 31 - d) different IPv6 address space trees can be generated. When d = 4, 3.42 * 10 32 different IPv6 address space trees can be constructed.

[0109] c) The pre - set general DHC clustering strategy

[0110] The purpose of 6Probe is to obtain more low - dimensional patterns, so a pre - set general DHC clustering strategy is used to construct the IPv6 address space forest. 6Probe splits the DHC clustering splitting strategy into two key elements: the DHC variable - dimension splitting array SplitArray and the DHC clustering splitting order SplitOrder.

[0111] During DHC clustering, these two elements are equivalent to a pointer, which selects one dimension from multiple variable dimensions of the node at each layer to split and generate the child nodes of the node. Repeat the above operation at each layer until all nodes reach the DHC splitting threshold, and these nodes form the IPv6 address space tree.

[0112] ⅰ. The DHC variable - dimension splitting array

[0113] The position of the pointer is determined by the DHC variable - dimension split array. Each value in SplitArray is the relative position of the variable dimension to be split in the node pattern, not the absolute position of the variable dimension in the node pattern. The generated DHC variable - dimension split array is SplitArray = {var_Dim_0, var_Dim_1,..., var_Dim_31}. When performing DHC clustering on nodes at the i - th layer of the IPv6 address - space tree, the var_Dim_i - th variable dimension of the node will be split (specify the value of this dimension). In Figure 4 In (a) of

[0114] Figure 4 Since SplitArray[0]=0, when splitting the first - layer nodes (root nodes) of the IPv6 address - space tree, the first variable dimension in the node pattern will be split (relative position: 0, absolute position: 28, marked in red in the figure). SplitArray[1]=0, when splitting the second - layer nodes in the IPv6 address - space tree, the first variable dimension in the node pattern will be split (relative position is 0, dimension subscript in the pattern is 29, marked in red in the figure).

[0115] There are two types of SplitArrayType for constructing SplitArray: sequential and random.

[0116] The overall order of multiple DHC variable - dimension split arrays constructed in the sequential manner is equivalent to the circular shift of the variable dimensions in the root - node pattern. Therefore, the relative order of most variable dimensions in these arrays is the same. Assume that the pattern dimension of the root node (the number of variable dimensions in the node pattern) is D root , and the split - threshold dimension of DHC clustering is D1. Then, a total of (D root - D1) variable dimensions are split during clustering. By restricting the last D1 variable dimensions of the root - node pattern not to be split, a total of D root - D1 DHC variable - dimension split arrays can be constructed in the sequential manner ({0, 1,..., D root - D1}, {1, 2,..., D root - D1, 0},..., {D root - D1, 0,..., D root-D1-1}), that is, a total of D root -D1 IPv6 address space trees can be constructed.

[0117] Constructing the DHC variable-dimension segmentation array in a random manner is equivalent to root -permuting and combining D1 variable dimensions, and a total of A(D root -D1, D root -D1) DHC variable-dimension segmentation arrays can be generated, that is, a total of (D root -D1)! IPv6 address space trees can be constructed.

[0118] Perform DHC clustering on the pattern 2001::****, set D1 = 1, SplitOrder = Left, and restrict the variable dimensions of the maximum relative position from splitting. If SplitArrayType = sequential, a total of 3 DHC variable-dimension segmentation arrays can be generated, and 3 IPv6 address space trees can be constructed. If SplitArrayType = random, a total of A(3, 3) = 6 DHC variable-dimension segmentation arrays can be generated, and 6 IPv6 address space trees can be constructed.

[0119] Figure 4 In (a) and (b), a SplitArray is generated in sequential and random manners respectively, and two IPv6 address space trees (ideally, without considering the influence of seed addresses) are constructed under the guidance of the DHC clustering order of Left (from left to right). Due to the different DHC variable-dimension segmentation arrays of the two, the intermediate nodes in the two IPv6 address space trees are inconsistent. Figure 4 In (a) and (b) of, the node patterns of the second and third layer nodes are different. Figure 4 In (a) of, the variable dimensions below the node pattern of the second layer nodes are 29, 30, and 31 respectively, while Figure 4 In (b) of, the variable dimensions below the node pattern of the second layer nodes are 28, 29, and 31 respectively. Due to the uneven distribution of seed addresses, the leaf nodes in the complete 16-ary tree are loss nodes (the number of seed addresses contained in the leaf nodes is lower than the threshold), that is, the leaf nodes in the IPv6 address space tree are mostly the intermediate nodes in the complete 16-ary tree, thus providing the possibility for constructing an IPv6 address forest to increase the number of low-dimensional patterns.

[0120] ⅱ. DHC Clustering and Segmentation Order

[0121] The direction of the pointer is determined by the DHC clustering split order (SplitOrder). When the DHC variable - dimension split array is determined, the IPv6 address - space trees constructed according to different DHC clustering split orders are also different. There are two values for SplitOrder: Left (from left to right, left - split order) and Right (from right to left, right - split order).

[0122] For the same DHC variable - dimension split array, different SplitOrders will construct two different IPv6 address - space trees during DHC clustering. During DHC clustering, SplitOrder affects both the position of the variable dimension selected for splitting at the current layer and the position of the variable dimension finally retained in the node pattern.

[0123] Figure 4 In (a) and (c), the DHC variable - dimension split arrays constructed during DHC clustering are both SplitArray = {0, 0, 0}, but the DHC clustering split orders adopted are inconsistent, which are Left and Right respectively. Figure 4 In (a), the variable dimensions split at the first, second, and third layers of the IPv6 address - space tree are the first variable dimension on the left of the current node (the dimension subscripts are 28, 29, and 30) respectively, while Figure 4 in (b), the variable dimensions split at the first, second, and third layers of the IPv6 address - space tree are the first variable dimension on the right of the current node (the dimension subscripts are 31, 30, and 29) respectively. Although Figure 4 the relative positions of the retained variable dimensions in (a) and (b) are the same (both are the last variable dimension in the direction of the DHC clustering split order), their absolute positions in the node pattern are inconsistent, and the dimension subscripts are 31 and 28 respectively.

[0124] ⅲ. The origin of the IPv6 address generation algorithm and two key elements

[0125] Algorithms such as 6Scan adopt the strategy in the previous section to construct a single IPv6 address - space tree, then generate target addresses in the pattern space of the IPv6 address - space tree, and finally detect the target addresses and collect the responding IPv6 active addresses.

[0126] 6Probe first constructs an IPv6 address - space forest, then merges the low - dimension pattern nodes in the IPv6 address - space forest, and detects in the low - dimension pattern space to collect IPv6 active addresses. 6Probe constructs multiple DHC variable - dimension split arrays in a random way, and constructs multiple IPv6 address - space trees according to the variable dimensions in the pattern using the Right (from right to left) DHC clustering split order, thus forming an IPv6 address - space forest.

[0127] ⅳ. Rightmost variable dimension splitting strategy

[0128] Aiming at the scenario of predicting IPv6 active prefixes, the present invention designs a new DHC segmentation strategy: Rightmost Variable Dimension Segmentation Strategy RightVDPS.

[0129] When constructing the IPv6 address space tree, the IPv6 target address generation algorithm that adopts the rightmost variable dimension splitting strategy splits from right to left according to the variable dimension in the pattern until the number of IPv6 seed addresses in the node is lower than the threshold or the node pattern dimension is lower than the threshold.

[0130] RightVDPS prioritizes splitting the variable dimension of the IID part based on the seed address, and predicts active addresses in the unsplit variable dimension space (usually with or without splitting the IPv6 prefix part).

[0131] RightVDPS logic is as follows Figure 5 As shown in (b), unlike the leftmost variable dimension splitting strategy (LeftVDPS), RightVDPS constructs the IPv6 address space tree by splitting the variable dimensions from right to left to generate IPv6 address patterns (leaf nodes in the space tree). The variable dimensions in an IPv6 address pattern are typically distributed within the IPv6 prefix. RightVDPS then generates an IPv6 target address within the pattern space of the IPv6 address pattern and collects the active addresses that respond after detection.

[0132] Figure 5 The logic for RigtVDPS and LeftVDPS. Figure 5 (a) and (b) represent the logic of LeftVDPS and RightVDPS, respectively. As shown in (a), LeftVDPS constructs the IPv6 address space tree by splitting the variable dimensions from left to right. The variable dimensions of the IPv6 address pattern in the space tree are typically distributed in the IID portion (blue boxes). As shown in (b), RightVDPS constructs the IPv6 address space tree by splitting the variable dimensions from right to left. The variable dimensions of the IPv6 address pattern in the space tree are typically distributed in the IPv6 prefix portion (green boxes).

[0133] Figure 1 The example above illustrates that low-dimensional patterns account for a very small proportion of the IPv6 address space. It is far from sufficient to generate IPv6 destination addresses only in the low-dimensional pattern space and a small portion of the high-dimensional pattern space of the IPv6 address space tree. It is necessary to detect the loss space and high-dimensional pattern space.

[0134] Figure 6The example of the 6Probe (the present invention) generating an IPv6 address pattern based on a seed address shows that 6Probe generates an IPv6 address pattern by constructing an IPv6 address space forest. Figure 6 Nodes 49 to 96 in the IPv6 address space forest of Figure 6 are generated by the rightmost variable dimension splitting strategy for the IPv6 seed address. The target addresses generated by these low-dimensional nodes cover 16 / 112 IPv6 prefixes, while the target addresses generated by the leftmost dimension variable strategy only cover 2 / 124 IPv6 prefixes. This indicates that the rightmost variable dimension splitting strategy can be used to predict IPv6 active prefixes.

[0135] Figure 6 A total of 18 unique low-dimensional patterns and 4 unique high-dimensional patterns are generated. The low-dimensional space and the high-dimensional space are 0.16% and 22.65% of the root node IPv6 address space size respectively, compared with Figure 1 which are increased by 285.71% and 241.74% respectively. Pattern 2001:11* is a sub-pattern of the high-dimensional pattern 2001::***, pattern 2001::211* is a sub-pattern of the loss pattern 2001::2***, and pattern 2001:11* and pattern 2001::211* are low-dimensional patterns respectively.

[0136] This shows that the IPv6 address space forest contains Figure 1 partial highly active regions of high-dimensional patterns and loss patterns. Reasonable merging of the IPv6 address space tree can generate more patterns, that is, more IPv6 active addresses can be detected in the merged pattern space, reflecting the superiority and necessity of constructing the IPv6 address space forest.

[0137] Figure 7 The result comparison between the IPv6 address space tree and the IPv6 address space forest is given. Disadvantages of the IPv6 address space tree: Figure 1 It contains 2 low-dimensional nodes (nodes 33 to 34), 2 high-dimensional nodes (nodes 1, node 17) and 42 loss pattern nodes (nodes 3 to 16, nodes 19 to 32, nodes 35 to 48). Main advantages of the IPv6 address space forest 6ASForest: Figure 6 It contains 18 low-dimensional patterns and 5 high-dimensional patterns, with the composition increasing by 800% and 67% respectively compared with methods such as 6Scan. Some address regions in the loss pattern space and the high-dimensional pattern space are converted into low-dimensional patterns by 6ASForest.

[0138] In summary, the IPv6 address space forest generates a larger number of low-dimensional address patterns, expanding the low-dimensional pattern space. RightVDMS expands the low-dimensional pattern space from a 124-bit prefix to a 112-bit prefix.

[0139] d) Analysis of the Expected Effects of the 6Probe Algorithm

[0140] In the entire IPv6 address space, the active address space is A. The 6Probe algorithm additionally constructs m IPv6 address space trees. In the i-th IPv6 address space tree, there are r[i] low-dimensional node patterns and p[i] high-dimensional node patterns, with a total of q[i] node patterns. The IPv6 address space of the j-th node pattern in the i-th IPv6 address space tree can be represented as S ij , and the loss space discarded when constructing the IPv6 address space tree is Q[i].

[0141] Then, the total IPv6 active addresses detected by 6Probe can be expressed by the following formula:

[0142]

[0143] There exist a, b, c, d, e (0 ≤ a ≤ m, 1 ≤ b ≤ r[a], 0 ≤ c ≤ m, 1 ≤ d ≤ r[c], (r[a] + 1) ≤ e ≤ q[a]). By using the strategy of additionally constructing IPv6 address space trees to detect IPv6 addresses within the Internet scope, the following three effects can be achieved:

[0144] (1) Detect in the high-active area of the loss space. As shown, there is an intersection between the loss space of the a-th IPv6 address space tree and the low-dimensional pattern space of the c-th IPv6 address space tree. This indicates that when detecting the low-dimensional pattern of the c-th IPv6 address space tree, the loss space of the a-th IPv6 address space tree is detected.

[0145] (2) Detect in the high-active area of the high-dimensional space. As shown, there is an intersection between the high-dimensional node pattern space of the a-th IPv6 address space tree and the low-dimensional pattern space of the c-th IPv6 address space tree. This indicates that when detecting the low-dimensional pattern space of the c-th IPv6 address space tree, the high-dimensional pattern space of the a-th tree is detected.

[0146] (3) Detect both the high-active area of the high-dimensional space and the high-active area of the loss space simultaneously. As shown, there are intersections between both the loss space and the high-dimensional node space of the a-th IPv6 address space tree and the low-dimensional pattern space of the c-th IPv6 address space tree.

[0147] In summary, the key improvement of the present invention over the prior art lies in being able to identify the high-active areas in the loss pattern space and the high-dimensional pattern space of a single IPv6 address space tree, expanding the prediction space, and increasing the number of predicted IPv6 active addresses.

[0148] Aiming at the problem of the small number of predicted active addresses in the existing IPv6 destination address generation algorithm, the present invention proposes an IPv6 address space forest technology. 6Probe generates more IPv6 address patterns by constructing an IPv6 address space forest, expands the prediction space, and increases the number of predicted IPv6 active addresses.

[0149] Aiming at the problems of the inability to detect the loss pattern space and the high cost of detecting the active regions in the high-dimensional pattern space, the present invention designs and implements a preposed general DHC clustering and segmentation strategy. By constructing multiple IPv6 address space trees, the high-active regions in the loss pattern space and the high-dimensional pattern space are transformed into low-dimensional patterns, thereby increasing the number of IPv6 active addresses predicted by the algorithm. By separating the core elements of the DHC clustering technology into two core elements, namely the DHC variable-dimension segmentation array and the DHC clustering and segmentation order, the process of constructing the IPv6 address space tree is made controllable. The pattern dimension threshold in the IPv6 address space tree is set to 4, and theoretically, 3.42*10 32 IPv6 address space trees can be constructed.

[0150] e) Performance evaluation

[0151] To evaluate the performance of 6Probe in predicting IPv6 active addresses, a dataset is constructed by collecting live IPv6 addresses from public data sources, and experiments are carried out in a real IPv6 network environment and compared with the current five mainstream IPv6 network topology detection technologies, namely 6Gen, 6Tree, 6Hit, HMap6, and 6Scan.

[0152] 1) Experimental environment

[0153] All the experiments of the present invention are carried out on a 3-core 4G server in Los Angeles with a bandwidth of 500 Mbps. Since the differences in IPv6 address measurement at different locations are extremely large and the effect of IPv6 address measurement in Los Angeles is better, all the experiments of the present invention are carried out on the servers in Los Angeles.

[0154] As an implementable mode, the present invention limits the IPv6 address measurement bandwidth to 30 Mbps, which is much lower than algorithms such as 6Tree, HMap6, and 6Scan, ensuring to reduce the impact of IPv6 address measurement on Internet users.

[0155] The present invention uses a scanner with ICMPv6 probes to evaluate the performance of other IPv6 target address generation algorithms such as 6Probe and HMap6. The ICMPv6, TCP, and UDP protocols all support the detection of the liveness of IPv6 addresses. As a network layer protocol, ICMPv6 has good generality, and a scanner using ICMPv6 probes can achieve high effectiveness when detecting IPv6 addresses. IPv6 target address generation algorithms such as 6Scan, DET, 6Graph, and others, as well as Gasser et al., have experimentally confirmed that ICMPv6 detection has the highest response rate.

[0156] Considering that alias addresses consume the IPv6 target address detection budget for IPv6 target address generation, 6Probe uses an alias prefix detection algorithm based on the longest prefix match provided by Gasser et al. to eliminate alias addresses in the IPv6 target addresses. The active addresses in all the charts of the present invention are IPv6 active addresses after removing alias addresses.

[0157] 2) Seed address set construction

[0158] Gasser et al. obtained a seed address source IPv6 Hitlist containing server, router, and client addresses from multiple public data sources such as domain name lists, Bitnodes, and through traceroute measurements. The Hitlist used in the present invention was published on February 3, 2024, and contains approximately 12.71 million global IPv6 active addresses.

[0159] Song et al. proposed a heuristic method for collecting seed addresses, traversing the assigned prefixes in sequence to generate target addresses to obtain a dataset Song-Source with a wider prefix distribution and a larger number of addresses. The present invention uses the heuristic method for collecting seed addresses and collected a dataset Song-Source containing approximately 5.57 million global IPv6 active addresses on January 16, 2025.

[0160] Adopting the downsampling method can make the IPv6 address structure in the seed set as similar as possible to the seed address source. Therefore, the present invention uses the downsampling method to generate a seed set, randomly extracting a certain number of addresses from the IPv6 Hitlist as the IPv6 balanced seed set C x (x ∈ [1, 2, 3, 4, 5]).

[0161] To test the impact of the IPv6 unbalanced seed set on the IPv6 target address generation algorithm, the present invention collected an IPv6 seed set C distributed in a small number of prefixes from the Hitlist by controlling the sampled IPv6 address range. y(y ∈ [6, 7]), a large-scale IPv6 seed set C was collected from the Hitlist by controlling the sampling scale. z (z ∈ [8, 9]).

[0162] It is necessary to test the IPv6 target address generation algorithm with a diverse data set. Therefore, the present invention randomly extracts a certain number of addresses from Song-Source as the IPv6 balanced seed set C. 10 .

[0163] The detailed information of these seed sets is shown in Table 2.

[0164] Table 2 Information of Seed Address Sets

[0165]

[0166]

[0167] 3) In-network Testing of Different IPv6 Target Address Generation Algorithms

[0168] The present invention constructs three scenarios by controlling three parameters: the quality of the IPv6 seed set, the dimension of the IPv6 address detection mode, and the IPv6 target address generation budget, to verify the generality of the 6Probe algorithm. The specific data of the 6Probe and algorithms such as 6Scan tested in different scenarios are shown in Table 4.

[0169] To demonstrate the effect of the 6Probe algorithm strategy, an IPv6 address generation algorithm Left that only adopts the leftmost splitting strategy and only probes the low-dimensional pattern space was developed.

[0170] ⅰ. IPv6 Balanced Seed Set & Low-Dimensional Pattern Scenario

[0171] Figure 8 Table 3 and Table 4 respectively show the IPv6 active addresses detected, the target addresses generated, and the scale of the generated low-dimensional nodes by different IPv6 target generation algorithms in the balanced IPv6 seed address sets C1 - C5 and C. 10 The 6Probe generates more IPv6 address patterns and IPv6 target addresses. On C5, these data are 81972 and 700.78M respectively, which are 5.47 - 20.01 times and 2.44 - 2.46 times those of algorithms such as 6Scan. On C.

[0172] On C, these data are 85777 and 826.53M respectively, which are 21.41 - 115.45 times and 10.47 - 10.48 times those of algorithms such as 6Scan. As the scale of the IPv6 seed addresses increases, this effect becomes more obvious. 10 As the scale of the IPv6 seed addresses increases, this effect becomes more obvious.

[0173] Figure 8 Performance of different IPv6 target address generation algorithms on the balanced seed set. Figure 8 In (a), (b), and (c), the comparisons of the number of detected IPv6 active addresses, the number of generated IPv6 target addresses, and the number of generated low-dimensional patterns by different IPv6 target address generation algorithms are shown respectively.

[0174] 6Probe generates more IPv6 address patterns and more IPv6 target addresses by generating a forest of IPv6 address spaces, converting the loss space in a single IPv6 address space tree and the highly active regions in the high-dimensional space into low-dimensional patterns.

[0175] Compared with algorithms such as C5 and HMap6, the number of IPv6 target addresses generated on C 10 is less, while 6Probe generates more IPv6 target addresses on C 10 . Compared with the seed address source Hitlist, the number of seed addresses in the seed address source Song is less and the address distribution is sparse. Therefore, algorithms such as HMap6 construct a single IPv6 address space tree and generate fewer IPv6 address patterns, resulting in even fewer generated IPv6 target addresses. 6Probe generates more IPv6 address patterns by constructing a forest of IPv6 address spaces, thus generating more IPv6 target addresses.

[0176] Table 3 Performance of active addresses, target addresses, alias addresses, and low-dimensional patterns of different IPv6 target address algorithms on the balanced seed address C 10 in terms of the number of active addresses, target addresses, alias addresses, and low-dimensional patterns of different IPv6 target address algorithms on C

[0177] Algorithm Active Address Target Address Alias Address [[ID= ​ 386.29M 826.53M 2.38M 85777 ​ 20.2M 78.89M 1.76M 4006.33 ​ 35.37M 78.89M 1.86M 743 ​ 28.07M 78.89M 0.66M 743 ​ 19.01M 78.93M 0.92M 3723.33 ​ 34.43M 78.98M 1.13M 743

[0178] ⅱ. Scenario with the same IPv6 balanced seed set & IPv6 target address budget

[0179] ​ This shows the number of detected active addresses and the hit rate of algorithms such as 6Probe and HMap6 when the budget is 668M on the balanced seed set C5.

[0180] The strategies for generating IPv6 target addresses by 6Probe and algorithms such as 6Scan are different. 6Probe preferentially detects low-dimensional patterns based on prior knowledge of seed density, while algorithms such as 6Scan dynamically guide the generation of IPv6 target addresses based on feedback strategies.

[0181] 6Probe detects the largest number of IPv6 active addresses and has the highest hit rate, which are 107.79M and 15.38% respectively. By ​As can be seen from Figure (c) and Table 4, the number of low-dimensional nodes generated by 6Probe on C5 is 81,972, which is 5.47 to 20.01 times that of algorithms such as HMap6.

[0182] The larger scale of low-dimensional nodes generated by 6Probe indicates that 6Probe can detect high-density regions in high-dimensional space and loss space. With the same budget on C5, 6Probe detects more IPv6 active addresses, indicating that when the number of low-dimensional nodes is sufficient, the strategy of 6Probe for detecting low-dimensional patterns is superior to feedback-based strategies such as 6Scan.

[0183] ⅲ. Scenario with the same IPv6 balanced seed set and IPv6 target address budget

[0184] HMap6 adopts both DHC and AHC clustering strategies, generating more low-dimensional patterns than algorithms such as 6Scan that adopt only one clustering strategy. Therefore, in the case of unbalanced seeds, only 6Probe and HMap6 are compared.

[0185] Under two scenarios of less prefix distribution (C6, C7) and a large number of IPv6 seed addresses (C8, C9), the performance of 6Probe and HMap6 is tested, as shown in Table 4.

[0186] C3, C6, and C7 are IPv6 seed sets with the same seed scale and different IPv6 address prefix distributions. The number of IPv6 addresses detected by 6Probe on C3, C6, and C7 are 21.33M, 2.02M, and 3.24M respectively. This shows that an IPv6 seed set with a wide prefix distribution as much as possible and consistent with the actual IPv6 address space distribution is necessary for IPv6 target address generation.

[0187] C8 and C9 are large-scale IPv6 seed sets, with the number of IPv6 addresses being 0.2M and 0.5M respectively. The number of IPv6 active addresses detected by 6Probe and HMap6 on large-scale seed sets are 1.80 to 55.06 times and 1.47 to 16.36 times respectively of those detected on the balanced seed set, indicating that with the same IPv6 seed address distribution, increasing the scale of IPv6 seed addresses can improve the scale of IPv6 active addresses detected by the IPv6 target address generation algorithm.

[0188] On C6 and C7, the IPv6 active addresses, IPv6 target addresses generated, and low-dimensional nodes generated by 6Probe are 1.38 to 1.71 times, 1.66 to 2.21 times, and 4.31 to 5.40 times those of HMap6 respectively. On C8 and C9, these ratios are 3.66 to 4.93 times, 2.87 to 3.47 times, and 5.31 to 7.13 times respectively.

[0189] This shows that whether the IPv6 seed addresses are unevenly distributed or the scale of IPv6 seed addresses is large, 6Probe can explore the high-dimensional space and highly active regions in the loss space of the IPv6 address space tree.

[0190] Table 4 Test details of different IPv6 target address generation algorithms

[0191]

[0192]

[0193] ⅳ. Time and space overhead

[0194] Table 5 shows the number of active addresses detected, time overhead, and memory occupancy of different IPv6 target address generation algorithms when the budget is 700.78M on the balanced seed set C5.

[0195] 6Probe takes the longest time to cluster the seed addresses, which is 41 seconds, while the total time overhead of the algorithm is the shortest, which is 5 hours 27 minutes and 42 seconds. When clustering the seed addresses, 6Probe constructs multiple IPv6 address space trees, thus increasing the time overhead of clustering. Compared with algorithms such as 6Scan, the ICMPv6 probe packets sent by 6Probe do not have an address region coding field. Therefore, at the same bandwidth, the detection rate of 6Probe is faster and the total time overhead of the algorithm is the shortest.

[0196] The total time overhead of 6Hit is the longest, which is 7 hours 58 minutes and 13 seconds. The feedback strategy of 6Hit is complex and frequent. After each round of detection, 6Hit executes the feedback strategy, thus increasing the overall time overhead.

[0197] The maximum memory overhead of 6Probe is 1.87G, which is lower than that of algorithms such as 6Scan. 6Probe constructs an IPv6 address space forest, generates IPv6 target addresses, and the detection phase is independent, so the memory occupied is small. Algorithms such as 6Scan need additional space to save the states of nodes in the IPv6 address space tree in order to maintain a high hit rate during detection in the active regions of the IPv6 address space tree. Therefore, the space overhead of algorithms such as 6Scan is large.

[0198] Table 5 Resource consumption and scanning rate of different IPv6 target generation algorithms with the same budget on the seed address set C5

[0199] ​ ​ ​ ​ ​ 100.79M 05:27:42(00:00:41+00:20:51+05:06:10) 1.87G ​ 40.20M 06:00:20(00:00:02+06:00:18) 5.61G ​ 42.22M 06:03:12(00:00:01+06:03:11) 5.55G ​ 50.24M 06:05:26(00:00:01+06:05:25) 5.47G ​ 65.08M 07:58:13(00:00:01+07:58:12) 5.82G ​ 54.26M 05:44:19(00:00:02+05:44:18) 5.55G

[0200] Since scanning and detection are carried out simultaneously when generating IPv6 target addresses (t_generate + t_probe), algorithms such as HMap6 only have two parts.

[0201] 4) Loss Space & Pattern Dimension

[0202] In this subsection, experiments are first conducted to illustrate the challenges of the overly large loss space scale and the overly small low-dimensional pattern space scale in the IPv6 address space tree. Subsequently, experiments on the relationship between the pattern dimension and the hit rate are carried out, and based on this, the maximum variable dimension threshold for low-dimensional patterns is set for 6Probe, that is, the maximum number of "*" in the pattern.

[0203] ⅰ. A Vast Loss Space

[0204] Table 6 shows the sizes of various pattern spaces on different datasets. The sparsity and uneven distribution characteristics of IPv6 seed addresses result in a large number of loss patterns being generated during the process of constructing the IPv6 address space tree through DHC clustering.

[0205] The entire IPv6 global unicast address space size is 4.25 * 10 37 , and on the seed sets C1, C2, C3, C4, C5, the space scale of all loss patterns generated through DHC clustering is the same as the IPv6 global unicast address space size, which is 4.25 * 10 37 .

[0206] The size order of magnitude of all seed pattern spaces in the IPv6 address space tree is 10 33 ~10 34 , while the size order of magnitude of the low-dimensional pattern space is 10 7 ~10 8 . On C5, the size of the low-dimensional pattern space in the constructed IPv6 address space tree is only 1.53 * 10 8 , which are 1 / 10 25 and 1 / 10 29 of the total pattern size and the total IPv6 address space size respectively.

[0207] This indicates that when detecting IPv6 active addresses, it is far from enough to be limited to the low-dimensional pattern space of only one IPv6 address space tree.

[0208] Table 6 Different Pattern Spaces of the IPv6 Address Space Tree

[0209]

[0210] ⅱ. Relationship between Pattern Dimension and Hit Rate

[0211] The association between the pattern dimension and the hit rate of the IPv6 target address generation algorithm was tested on dataset C2, as shown in Table 7.

[0212] As the pattern dimension increases, the overall average hit rate of the pattern shows a downward trend. When the pattern dimension is less than or equal to 4, the average pattern hit rate is higher than 30%. However, when the pattern dimension increases to 5 and 6, the average pattern hit rate drops rapidly, reaching 4.53% and 2.22% respectively. Therefore, in the experiments of the present invention, the maximum dimension of the low-dimensional pattern is set to 4.

[0213] The target addresses generated by patterns with a larger seed density are more likely to be active. As the pattern dimension increases, the size of the pattern space grows exponentially, so the cost of probing high-dimensional patterns also grows exponentially.

[0214] Relationship between patterns with different dimensions and hit rates on Table 7C2

[0215]

[0216]

[0217] 5) 6 Probe parameter tuning

[0218] Tuning is carried out from two aspects: the DHC segmentation strategy and the number of IPv6 address space trees, so that the IPv6 target address generation algorithm can generate more target addresses on different scales of seeds, and at the same time the IPv6 address space forest contains a smaller number of IPv6 address space trees.

[0219] It is necessary to test the optimal value of the number of IPv6 address space trees, which can not only obtain target addresses with a higher activity rate, but also ensure that the time and space overheads for constructing the IPv6 address space tree are not too large.

[0220] ⅰ. Tuning of the DHC segmentation strategy

[0221] The preposed DHC clustering segmentation strategy includes two core elements: the DHC variable-dimension segmentation array (SplitArray) and the DHC clustering segmentation order (SplitOrder).

[0222] "No" means not constructing an additional IPv6 address space tree. The dimension of the SplitArray array constructed by "Right", "Left", and "Random" is 20, that is, 20 IPv6 address space trees are constructed. Among them, the strategies for constructing the SplitArray array by "Left" and "Right" are sequential, while the strategy for constructing the SplitArray array by "Random" is random. The SplitOrder strategies adopted by "Left", "Right", and "Random" are the left segmentation order and the right segmentation order respectively.

[0223] Such as ​As shown in the figure, on datasets C1, C2, C3, C4, and C5, the number of IPv6 active addresses detected by RightVDPS is slightly higher than that of LeftVDPS, indicating that in the SplitOrder strategy, the left split order is more effective than the right split order. Therefore, the "Random" SplitOrder strategy is set to the right split order.

[0224] The number of IPv6 active addresses that "No" can detect is much smaller than the other three strategies, only 19.86% - 47.4% of the number of IPv6 active addresses detected by the "Random" strategy. No matter which strategy is used to construct the IPv6 address space forest, the number of IPv6 active addresses detected is more than that of constructing only a single IPv6 address tree. The number of IPv6 active addresses detected by the "Right" and "Left" strategies is similar on different datasets, and the "Random" strategy detects the most IPv6 active addresses on each dataset, and this effect is more obvious as the scale of the seed addresses increases. This shows that after the number of additional constructed IPv6 address space trees reaches a certain amount, it is not enough to only adjust the DHC clustering split order strategy of the fixed split dimension array, and the difference degree of the dimension array of each IPv6 address space tree also needs to be improved.

[0225] ⅱ. Tuning the number of IPv6 address space trees

[0226] ​ The relationship between the number of additional constructed IPv6 address space trees and the active addresses that can be detected is explored, where the split dimension array of DHC clustering is randomly generated. Generally, the more the number of space trees contained in the IPv6 address space forest, the more IPv6 active addresses can be detected. On dataset C5, constructing 40 additional IPv6 address space trees can discover 100.95M IPv6 active addresses, and the number of active addresses is 675.38% of that without constructing additional IPv6 address space trees.

[0227] On small-scale seed sets (C1, C2, C3), it is optimal to construct 20 additional IPv6 address space trees, which can discover more IPv6 active addresses, and at the same time, the time and space overheads of the algorithm are lower than those required for constructing 30 and 40 IPv6 address space trees. On larger datasets (C4, C5), it can be seen that the number of IPv6 addresses that can be detected by constructing 40 IPv6 address space trees is significantly higher than that detected by constructing 20 IPv6 address space trees.

[0228] Therefore, 6Probe constructs 20 and 40 additional IPv6 address space trees on small-scale and large-scale seed address sets respectively.

[0229] In summary, in view of the problem of the small scale of the predicted active address quantity existing in the existing IPv6 target address generation algorithm, the present invention designs and implements an IPv6 target address generation method 6Probe based on an address space forest.

[0230] By constructing an IPv6 address space forest, 6Probe converts the high-active regions in the loss pattern space and the high-dimensional pattern space into low-dimensional patterns, expands the low-dimensional pattern space, and thus increases the number of IPv6 active addresses in the low-dimensional pattern space. On the IPv6 balanced seed address set, the numbers of IPv6 active addresses detected by 6Probe, the numbers of IPv6 target addresses generated, and the numbers of low-dimensional nodes generated are respectively 2.6 to 4.81 times, 2.44 to 2.46 times, and 5.47 to 20.01 times those of algorithms such as 6Scan; on the IPv6 unbalanced seed address set, these ratios are respectively 137.87% - 492.74%, 165.65% - 346.78%, and 430.81% - 712.80%.

[0231] Based on the above embodiments, the present invention further provides an IPv6 target address generation system based on an address space forest, including:

[0232] an IPv6 address space forest construction module, configured to construct multiple IPv6 address space trees according to a pre-set DHC clustering segmentation strategy for the collected IPv6 seed addresses to form an IPv6 address space forest;

[0233] a pattern mining module, configured to filter out the low-dimensional nodes of different IPv6 address space trees, merge the patterns corresponding to the low-dimensional nodes, and then generate IPv6 target addresses in the low-dimensional pattern space; a node represents an IPv6 address pattern, and an IPv6 address pattern represents all IPv6 addresses belonging to this pattern;

[0234] a detection module, configured to filter out non-aliased IPv6 target addresses from the IPv6 target addresses in the low-dimensional pattern space, scan the non-aliased IPv6 target addresses, and collect the detected IPv6 active addresses.

[0235] The above are only the preferred embodiments of the present invention. It should be noted that for those of ordinary skill in the art, without departing from the principle of the present invention, several improvements and refinements can be made, and these improvements and refinements should also be regarded as the protection scope of the present invention.

Claims

1. An IPv6 destination address generation method based on an address space forest, characterized in that Including: Construct multiple IPv6 address space trees based on the pre-set DHC clustering segmentation strategy for the collected IPv6 seed addresses to form an IPv6 address space forest; Filter out the low-dimensional nodes of different IPv6 address space trees, merge the address patterns corresponding to the low-dimensional nodes, and then generate IPv6 target addresses in the low-dimensional pattern space; A node represents an IPv6 address pattern, and an IPv6 address pattern represents all IPv6 addresses belonging to this pattern; Filter out the non-alias IPv6 target addresses from the IPv6 target addresses in the low-dimensional pattern space, scan the non-alias IPv6 target addresses and collect the detected IPv6 active addresses.

2. The method for generating an IPv6 destination address based on an address space forest according to claim 1, wherein Construct the IPv6 address space forest in the following manner: Initialize the root node according to the IPv6 seed address, construct multiple DHC variable-dimensional segmentation arrays in a random manner, and sequentially split the variable dimensions in the address pattern according to the DHC clustering segmentation order from right to left until the number of IPv6 seed addresses in the node is lower than the threshold or the node pattern dimension is lower than the threshold, thereby constructing multiple IPv6 address space trees to form an IPv6 address space forest.

3. The method for generating an IPv6 destination address based on an address space forest according to claim 1, wherein When there are sufficient IPv6 seed addresses, the total number of nodes at the i-th layer of the IPv6 address space tree is 16 i-1 .

4. The method for generating an IPv6 destination address based on an address space forest according to claim 1, wherein In the case where the number of the IPv6 seed addresses is small and the distribution is uneven, there is a unique address space among the address patterns of the IPv6 address space trees constructed by different DHC clustering segmentation strategies.

5. The method for generating an IPv6 destination address based on an address space forest according to claim 1, wherein The number of IPv6 addresses included in the node exponentially decreases as the level of the node in the IPv6 address space tree increases.

6. The method for generating an IPv6 destination address based on an address space forest according to claim 1, wherein The pattern dimension of the low-dimensional pattern is lower than 4.

7. The method for generating an IPv6 destination address based on an address space forest according to claim 1, wherein The pre-set DHC clustering segmentation strategy includes a DHC variable-dimensional segmentation array and a DHC clustering segmentation order; the index position of the variable dimension for each DHC clustering segmentation is determined by the DHC clustering segmentation order, the layer number of the node in the space tree, and the DHC variable-dimensional segmentation array.

8. The method for generating an IPv6 destination address based on an address space forest according to claim 1, wherein The detected IPv6 active addresses are represented by the following formula: where A is the active address space in the entire IPv6 address space, m represents the number of additionally constructed IPv6 address space trees, r[i] represents the number of low-dimensional address patterns existing in the i-th IPv6 address space tree, S ij represents the IPv6 address space of the j-th node in the i-th IPv6 address space tree, Q[a] represents the loss pattern space discarded by the a-th IPv6 address space tree, 0 ≤ a ≤ m, 0 ≤ c ≤ m, 1 ≤ d ≤ r[c], (r[a] + 1) ≤ e ≤ q[a], and q[a] represents the number of address patterns existing in the a-th IPv6 address space tree. represents that there is an intersection between the loss pattern space of the a-th IPv6 address space tree and the low-dimensional pattern space of the c-th IPv6 address space tree. represents that there is an intersection between the high-dimensional node pattern space of the a-th IPv6 address space tree and the low-dimensional pattern space of the c-th IPv6 address space tree. represents that both the loss pattern space and the high-dimensional pattern space of the a-th IPv6 address space tree have intersections with the low-dimensional pattern space of the c-th IPv6 address space tree.

9. An IPv6 destination address generation system based on an address space forest, characterized in that, Including: An IPv6 address space forest construction module for constructing multiple IPv6 address space trees based on the pre-set DHC clustering segmentation strategy for the collected IPv6 seed addresses to form an IPv6 address space forest; A pattern mining module for filtering out the low-dimensional nodes of different IPv6 address space trees, merging the address patterns corresponding to the low-dimensional nodes, and then generating IPv6 target addresses in the low-dimensional pattern space; A node represents an IPv6 address pattern, and an IPv6 address pattern represents all IPv6 addresses belonging to this pattern; A detection module for filtering out the non-alias IPv6 target addresses from the IPv6 target addresses in the low-dimensional pattern space, scanning the non-alias IPv6 target addresses and collecting the detected IPv6 active addresses.

Images