Method and device for determining number of active addresses in network space, equipment and medium

Abstract

The embodiment of the invention discloses a method and device for determining the number of network space active addresses, equipment and a medium, the number of the network space active addresses is determined by adopting a mode of introducing random sampling and combining a convergence threshold value, resources for obtaining known active IPv6 addresses required by sampling detection are reduced, and the detection efficiency is improved. According to the invention, the number of active IPv6 addresses in a to-be-detected space can be determined accurately, the time overhead for generating the to-be-detected IPv6 address similar to the structure of the active IPv6 address is reduced, and the problem that the number of all the active IPv6 addresses in the to-be-detected space cannot be determined accurately due to limited known active IPv6 addresses or limited convergence times of a generation algorithm, so that the accuracy of determining the number is not high is solved. And the accuracy of determining the number of active addresses in the network space is improved.

Description

Technical Field

[0001] The present application relates to the field of network detection technology, and in particular to a method, apparatus, device and medium for determining the number of active addresses in a network space. Background Art

[0002] With the continuous improvement of network scale, the number of network devices has shown explosive growth. The biggest problem currently faced by IPv4 networks is the shortage of network address resources, which seriously restricts the application and development of the Internet. The emergence of IPv6 networks has completely solved the problem of insufficient address resource allocation, and the number of IP addresses has increased by 2 compared to the number of IP addresses in IPv4 networks. 10 Given the vast amount of address space, how to determine the number of active addresses in the IPv6 network space has become an urgent problem to be solved.

[0003] At present, the main method for determining the number of active addresses in the network space is to obtain a known active IPv6 address, deduce the relationship between the corresponding byte bits based on the structural information of the IPv6 address itself, use a generation algorithm to generate an IPv6 address to be detected that is similar in structure to the active IPv6 address, and then directly perform active detection on the IPv6 address to be detected, thereby determining the number of active addresses in the IPv6 network space. However, this method only uses the currently known active IPv6 addresses as seed addresses for deduction. Since the known active IPv6 addresses are limited, the derived IPv6 addresses to be detected are also limited, and thus the number of all active IPv6 addresses in the space to be detected cannot be accurately determined. In addition, the generation algorithm is calculated using known active IPv6 addresses. Since the convergence number (generation number) of the generation algorithm is limited, the generated IPv6 addresses to be detected are limited, which also makes it impossible to accurately determine the number of all active IPv6 addresses in the space to be detected, resulting in a low accuracy rate for determining the number.

[0004] Therefore, there is an urgent need for a method that can accurately determine the number of active addresses in cyberspace. Summary of the Invention

[0005] The present application provides a method, apparatus, device, and medium for determining the number of active addresses in a network space, which are used to improve the accuracy of determining the number of active addresses in a network space.

[0006] An embodiment of the present application provides a method for determining the number of active addresses in a network space, the method comprising:

[0007] Receive input of the network space address range to be detected and the sampling scale;

[0008] For each sampling, within the range of the network space addresses to be detected, a sample of the network space addresses to be detected of the sampling scale is randomly selected; active detection is performed on the sample of the network space addresses to be detected to determine the active addresses; if the sampling is not the first sampling, a first estimated value of the number of active addresses determined by the sampling is determined based on the total number of active addresses determined by the sampling and before the sampling, the sampling scale, and the number of active addresses determined before the sampling that are located in the sample of the network space addresses to be detected by the sampling; if a first difference between the first estimated value and a second estimated value of the number of active addresses determined by the previous sampling adjacent to the sampling is less than a preset convergence threshold, the first estimated value is determined to be the number of active addresses in the network space.

[0009] In one possible implementation, after receiving the input network space address range to be detected and the sampling scale, for each sampling, before randomly extracting a sample of network space addresses to be detected of the sampling scale within the network space address range to be detected, the method further includes:

[0010] Receive the expected number of sampling times i and the type of network space address to be detected as input;

[0011] Obtaining a percentage value corresponding to the type of the network space address to be detected;

[0012] Determining the number of samples expected to be collected based on the proportion of the type of the network space address to be detected and a preset threshold;

[0013] Determine whether the expected number of samples is not greater than the actual number of samples collected determined by the sampling scale and the expected number of sampling times i. If so, determine that the actual number of samples is reasonable and proceed with the subsequent sampling process.

[0014] In a possible embodiment, the method further includes: if the expected number of samples is greater than the actual number of samples determined by the sampling scale and the expected sampling times i, prompting to re-enter the sampling scale and / or expected sampling times i, and receiving the re-entered sampling scale and / or expected sampling times i.

[0015] In one possible implementation, determining the expected number of samples to be collected based on the proportion of the type of the network space address to be detected and a preset threshold includes:

[0016] Determining the square value of the preset convergence threshold and the square value of the proportion of the type of the network space address to be detected;

[0017] Determine a first product value of the square value of the preset convergence threshold and the preset error threshold; determine the expected number of samples based on a first quotient value of the square value of the proportion of the type of network space address to be detected and the first product value.

[0018] In one possible implementation, determining a first estimate of the number of active addresses determined for the sampling sub-sampling based on the total number of active addresses determined for the sampling sub-sampling and prior to the sampling sub-sampling, the sampling scale, and the number of active addresses determined prior to the sampling sub-sampling that are in the sample of network space addresses to be detected for the sampling sub-sampling includes:

[0019] Determine the total number of active addresses determined for the sampling and the active addresses determined before the sampling based on the active addresses determined for the sampling;

[0020] Based on all addresses in the sampling and active addresses determined before the sampling, determine the number of active addresses determined before the sampling that are located in the sample of network space addresses to be detected in the sampling;

[0021] Determine a second quotient of the total number and the number; multiply the second quotient by the sampling size to determine a first candidate estimate of the number of active addresses determined by the sampling; and determine a first estimate of the number of active addresses determined by the sampling based on the first candidate estimate.

[0022] In a possible implementation, determining the total number of active addresses determined for the sampling and the active addresses determined before the sampling based on the active addresses determined for the sampling includes:

[0023] The active addresses determined in the sampling are combined with the active addresses determined before the sampling, and duplicate active addresses are removed to determine the total number of the active addresses determined in the sampling and before the sampling.

[0024] In a possible implementation, determining a first estimated value of the number of active addresses determined by the sampling according to the first candidate estimated value includes:

[0025] Determine a second difference between the first candidate estimated value and a second candidate estimated value of the number of active addresses determined in a previous sampling adjacent to the current sampling;

[0026] According to the second difference and the preset dynamically adjusted learning rate, a second product value of the second difference and the dynamically adjusted learning rate corresponding to the sampling is determined, wherein the preset dynamically adjusted learning rate corresponding to the sampling is i is the number of times the corresponding sampling occurs;

[0027] A first estimated value of the number of active addresses determined by the sampling is determined according to the sum of the second candidate estimated value of the adjacent previous sampling and the second product value.

[0028] An embodiment of the present application provides a device for determining the number of active addresses in a network space, the device comprising:

[0029] A receiving module, used to receive the input of the network space address range to be detected and the sampling scale;

[0030] A processing module is configured to randomly extract, for each sampling, a sample of the network space addresses to be detected of the sampling scale within the range of the network space addresses to be detected; perform active detection on the sample of the network space addresses to be detected to determine the active addresses; if the sampling is not the first sampling, determine a first estimated value of the number of active addresses determined by the sampling based on the total number of active addresses determined by the sampling and all samples before the previous sampling, the sampling scale, and the number of active addresses determined by all adjacent previous samplings before the sampling that are located in the sample of the network space addresses to be detected by the sampling; if a first difference between the first estimated value and a second estimated value of the number of active addresses determined by the previous sampling adjacent to the sampling is less than a preset convergence threshold, determine the first estimated value as the number of active addresses in the network space.

[0031] In a possible implementation, the receiving module is further configured to receive an input of an expected number of sampling times i and a type of the network space address to be detected;

[0032] The processing module is also used to obtain the proportion value corresponding to the type of the network space address to be detected, and determine the expected number of samples according to the proportion value of the type of the network space address to be detected and a preset threshold; judge whether the expected number of samples is not greater than the actual number of samples collected determined by the sampling scale and the expected number of sampling times i. If so, determine that the actual number of samples is reasonable, and perform subsequent sampling process.

[0033] In one possible embodiment, the processing module is also used to prompt for re-entry of the sampling scale and / or expected sampling number i if the expected number of samples is greater than the actual number of samples determined by the sampling scale and the expected sampling number i, and to receive the re-entered sampling scale and / or expected sampling number i.

[0034] In one possible embodiment, the processing module is specifically used to determine the square value of the preset convergence threshold and the square value of the proportion of the type of the network space address to be detected; determine the first product value of the square value of the preset convergence threshold and the preset error threshold; and determine the expected number of samples based on the first quotient value of the square value of the proportion of the type of the network space address to be detected and the first product value.

[0035] In one possible implementation, the processing module is specifically configured to determine the total number of active addresses determined in the current sampling and the previous sampling that was adjacent to the current sampling based on the active addresses determined in the current sampling and the active addresses determined in the previous sampling that was adjacent to the current sampling; determine a first number of the active addresses determined in the previous sampling that was adjacent to the current sampling that are located in the network space address sample to be detected in the current sampling based on all addresses in the current sampling and the active addresses determined in the previous sampling that was adjacent to the current sampling; determine a second quotient of the total number and the first number; multiply the second quotient by the sampling scale to determine a first candidate estimated value of the number of active addresses determined in the current sampling; and determine a first estimated value of the number of active addresses determined in the current sampling based on the first candidate estimated value.

[0036] In one possible implementation, the processing module is specifically configured to merge the active addresses determined by the current sampling and the active addresses determined by the previous sampling that was adjacent to the current sampling, remove duplicate active addresses, and determine the total number of active addresses determined by the current sampling and the previous sampling that was adjacent to the current sampling.

[0037] In one possible implementation, the processing module is specifically configured to determine a second difference between the first candidate estimated value and a second candidate estimated value of the number of active addresses determined by a previous sampling adjacent to the sampling; and determine a second product value of the second difference and the dynamically adjusted learning rate corresponding to the sampling based on the second difference and the preset dynamically adjusted learning rate, wherein the preset dynamically adjusted learning rate corresponding to the sampling is i is the number of times the sampling corresponds to this time; a first estimated value of the number of active addresses determined by this sampling is determined according to the sum of the second candidate estimated value of the adjacent previous sampling and the second product value.

[0038] An embodiment of the present application further provides an electronic device, comprising a processor, wherein the processor is configured to implement the steps of any of the above methods when executing a computer program stored in a memory.

[0039] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of any of the above methods are implemented.

[0040] In the present application, for each sampling, a sampling scale of network space address samples to be detected is randomly extracted from the range of network space addresses to be detected, and active detection is performed, and the active addresses discovered by active detection after the sampling are recorded; and a first estimated value of the number of active addresses determined by the sampling is determined; if the first difference between the first estimated value and the second estimated value of the number of active addresses determined by the previous sampling adjacent to the sampling is less than a preset convergence threshold, then the first estimated value is determined to be the number of active addresses in the network space. By adopting a combination of random sampling and convergence threshold to determine the number of active addresses in the network space, the resources required for obtaining known active IPv6 addresses required for sampling detection and the time overhead of generating IPv6 addresses to be detected with a structure similar to the active IPv6 address are reduced, and the problem of low accuracy of the number of active addresses determined due to the limited number of known active IPv6 addresses or the limited number of convergence times (generation times) of the generation algorithm is avoided, thereby improving the accuracy of determining the number of active addresses in the network space. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0042] Figure 1 A schematic diagram of a process for determining the number of active addresses in a network space provided in an embodiment of the present application;

[0043] Figure 2 A schematic diagram of a process for determining whether the number of samples actually sampled is reasonable, provided in an embodiment of the present application;

[0044] Figure 3 A schematic diagram of a process for determining the number of samples expected to be sampled provided in an embodiment of the present application;

[0045] Figure 4 One of the schematic diagrams of a process for determining a first estimated value of the number of active addresses determined by the sampling provided in an embodiment of the present application;

[0046] Figure 5A second schematic diagram of a process for determining a first estimated value of the number of active addresses determined by the sampling according to an embodiment of the present application;

[0047] Figure 6 A schematic diagram of the main steps for determining the number of active addresses determined by sampling provided by an embodiment of the present application;

[0048] Figure 7 A schematic diagram of the structure of a device for determining the number of active addresses in a network space provided in an embodiment of the present application;

[0049] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] In order to make the purpose and implementation of this application clearer, the exemplary implementation of this application will be clearly and completely described below in conjunction with the drawings in the exemplary embodiments of this application. Obviously, the described exemplary embodiments are only part of the embodiments of this application, not all of the embodiments.

[0051] It should be noted that the brief descriptions of terms in this application are only for the purpose of facilitating the understanding of the embodiments described below, and are not intended to limit the embodiments of this application. Unless otherwise specified, these terms should be understood according to their ordinary and usual meanings.

[0052] In the specification and claims of this application and the accompanying drawings, the terms "first," "second," "third," etc. are used to distinguish similar or similar objects or entities, and are not necessarily intended to limit a particular order or sequence, unless otherwise noted. It should be understood that the terms used in this manner are interchangeable under appropriate circumstances.

[0053] The terms "comprise," "include," and "have," and any variations thereof, are intended to cover but not exclude inclusion; for example, a product or device comprising a list of components is not necessarily limited to all the components expressly listed but may include other components not expressly listed or inherent to such product or device.

[0054] The term "module" refers to any known or later developed hardware, software, firmware, artificial intelligence, fuzzy logic, or combination of hardware and / or software code that is capable of performing the functionality associated with that element.

[0055] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some or all of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present application.

[0056] For ease of explanation, the above description has been made with reference to specific embodiments. However, the above exemplary discussion is not intended to be exhaustive or to limit the embodiments to the specific forms disclosed above. Based on the above teachings, various modifications and variations are possible. The above embodiments are selected and described to better explain the principles and practical applications, so that those skilled in the art can better utilize the embodiments and various different variations of the embodiments suitable for specific use considerations.

[0057] Example 1:

[0058] Figure 1 A schematic diagram of a process for determining the number of active addresses in a network space provided in an embodiment of the present application includes the following steps:

[0059] S101: Receive input of a network space address range to be detected and a sampling scale.

[0060] The method for determining the number of active addresses in a cyberspace provided in an embodiment of the present application is applied to an electronic device, which may be a computer (Personal Computer, PC), a server, etc.

[0061] Cyberspace address refers to all possible IP addresses allocated on the Internet, also known as IP address space, mainly including IPv4 and IPv6 versions of IP addresses. IPv4 address is a 32-bit (4-byte) IP address, usually expressed as a segment of 4 decimal characters, each segment is a decimal number from 0 to 255, and each segment is separated by a dot ".", for example, 192.168.1.1. An IPv6 address is a 128-bit (16-byte) IP address, typically represented as 8-character hexadecimal segments. Each segment is represented by 4 hexadecimal digits separated by colons (“:”). For example, 2001:0db8:85a3:0000:0000:8a2e:0370:7334 is an all-zero segment that can be compressed to “::”. Leading zeros in each segment can be omitted, so the IPv6 address 2001:0db8:85a3:0000:0000:8a2e:0370:7334 can also be represented as 2001:db8:85a3::8a2e:370:7334.

[0062] The network space address range to be detected refers to a range of network space addresses to be detected, including a starting network space address and an ending network space address. For example, network space address range A to be detected has a starting network space address of 2001:0000:0000:0000:0000:8a2e:0370:7334 and an ending network space address of 2001:0000:0000:0000:0000:8a2e:0370:8000; network space address range B to be detected has a starting network space address of 192.168.1.1 and an ending network space address of 198.179.1.1, etc. In addition, the network space address range to be detected can also be referred to as a set of addresses to be tested or a segment of addresses to be tested. The sampling scale refers to the number of samples selected from a range of network space addresses to be detected in each sampling.

[0063] The network address range to be detected and the sampling scale received by the electronic device are input by the user based on actual needs. In one possible implementation, the electronic device may further first determine the total number N of specific addresses contained in the received network address range to be detected, and then determine a recommended sampling scale based on the total number N of specific addresses and a pre-stored recommended sampling scale corresponding to the total number of addresses. The recommended sampling scale is then fed back to the display interface of the electronic device for user reference.

[0064] S102: For each sampling, randomly extracting a sample of the network space address to be detected of the sampling scale within the range of the network space address to be detected; performing active detection on the sample of the network space address to be detected to determine the active address.

[0065] For each sampling, within the range of the network space address to be detected, a sampling scale of network space address samples to be detected is randomly selected. That is, within the range of the network space address to be detected, after randomly selecting a sampling scale of m network space address samples to be detected, the set of sample addresses to be detected for this sampling is obtained, and can be recorded as C i ={a1,a5,a7,…,a x}, where i is the number of times the sample is taken, {a1,a5,a7,…,a x The number of network space addresses in the set is m, a x This represents the specific sample of network space addresses to be detected. When performing random sampling, uniform random sampling can be performed. Uniform random sampling means that for any network space address within the range of network space addresses to be detected, the probability P of being selected is the same.

[0066] For example, the network space address range to be detected is the network space address range A with a starting network space address of 2001:0000:0000:0000:0000:8a2e:0370:7334 and an ending network space address of 2001:0000:0000:0000:0000:8a2e:0370:8000. Assuming that the input sampling scale m is 100, then during the first sampling, the electronic device randomly extracts 100 network space address samples to be detected within the network space address range A to be detected, and records them as the sample set C1 = {a1, a2, a7, …, a x}, where {a1,a2,a7,…,a x There are 100 network space address samples to be detected in the set; during the third sampling, the electronic device randomly selects 100 network space address samples to be detected within the network space address range A to be detected, and records them as sample set C3 = {a1, a 21 ,a 71 ,…,a x1}, where {a1,a 21 ,a 71 ,…,a x1 There are 100 network space address samples to be detected in the collection.

[0067] Active detection tools are pre-deployed in electronic devices, such as network connection terminal scanning software (Network Mapper, nmap), network scanning tool zmap, or control message protocol (Internet Control Message Protocol Ping, icmp ping), etc., to determine whether a certain network space address sample to be detected has an open network service or is in a live state. In other words, the active detection tool is used to detect the sample set C of the sample to be detected. i Active detection is performed on all the network space address samples to be detected, and each network space address sample to be detected is determined to be an active address. Among them, how the active detection tool determines whether the network space address sample to be detected has an open network service or is in a live state is a prior art and will not be repeated here.

[0068] Through the pre-deployed active detection tools, the active detection of the network space address samples to be detected is carried out to determine the active addresses contained in the collected network space address samples to be detected, and the determined active addresses are recorded as H i ={a1,a2,…,a y}, where i is the number of times the sample is taken, and a y is the specific active address detected. For example, for C1={a1,a2,a7,…,a200} to perform active detection, and the active addresses determined are a1, a2, and a7, that is, H1 = {a1, a2, a7}; for C3 = {a1, a 21 ,a 71 ,…,a 101} Perform active detection and determine the active addresses as a1, a 21 、a 101 , that is, H3={a1,a 21 ,a 101 In addition, if we assume that the sample set to be detected in this sampling is C i , and assuming that the total set of active addresses in the address range of the network space to be detected is X, then the active addresses detected in this sampling are H i =|C i ∩X|, that is, the active address H detected in this sampling i It must be the sample set C to be detected in this sampling i The intersection with the total set X of active addresses in the address range of the network space to be detected.

[0069] S103: If the sampling is not the first sampling, a first estimated value of the number of active addresses determined in the sampling is determined based on the total number of active addresses determined in the sampling and before the sampling, the sampling scale, and the number of active addresses determined before the sampling that are located in the network space address sample to be detected in the sampling.

[0070] The total number of active addresses determined in this sampling and before this sampling refers to the sum of the number of active addresses determined in this sampling and the number of active addresses determined in all samplings before this sampling. In other words, the active addresses determined in this sampling and all active addresses detected before this sampling are recorded in the same set S i In the set S i The total number of elements in |S i |, that is, |S i | is the total number of active addresses determined by this sampling and all previous sampling. i It can be expressed as i is the number of times of the corresponding sampling, H i The active address determined for this sampling, that is, after the i-th sampling, the set S i The active addresses identified in this sampling and all active addresses detected before this sampling are included in the total number of |S i | Active addresses.

[0071] The number of active addresses identified before this sampling that are included in the sample of network space addresses to be detected in this sampling refers to the number of active addresses identified before this sampling that appear again in the sample of network space addresses to be detected in this sampling. In other words, the number of active addresses identified before this sampling that are included in the sample of network space addresses to be detected in this sampling can be expressed as |C i ∩S i-1 |, where C i is the network space address sample to be detected in this sampling, S i-1 These are all active addresses detected before this sampling.

[0072] For example, this sampling is the 4th sampling, and the sample set of this sampling is C4={a1,a 21 ,a 71 ,a 61 ,a 72 ,a 81 ,a 82 ,…,a x1}, and the active address set determined before the 4th sampling is S3={a1,a 21 ,a 71 ,a 72}, that is, in the sample set of the fourth sampling, the active addresses a1 and a2 that were determined before the fourth sampling appeared again. 21 、a 71 、a 72 , there are 4 active addresses that have been confirmed, that is, |C4∩S3|=4. Among them, the active addresses a1, a 21 、a 71 、a 72 It can be the active address detected in the first sampling, the active address detected in the second sampling, or the active address detected in the third sampling.

[0073] If this sampling is not the first sampling, determine the total number of active addresses determined before this sampling | S i |The number of active addresses identified before this sampling that appear again in the sample of network space addresses to be detected in this sampling|C i ∩S i-1 |The second quotient value; and determine the first estimated value of the number of active addresses determined by the sampling based on the product of the sampling scale and the second quotient value. That is, the first estimated value of the number of active addresses is calculated according to the proportion, that is, Among them, |X i | is the first estimate, m is the sampling size, A first estimated value of the number of active addresses determined by the sampling is determined as the second quotient.

[0074] The first estimated value may be an integer or a decimal. To ensure accurate determination of the number of active addresses in the cyberspace, if the first estimated value of the number of active addresses determined by the sampling is a decimal, the electronic device rounds the decimal to obtain the number of active addresses determined by the sampling, and determines this as the first estimated value of the number of active addresses determined by the sampling. Among them, the rounding operation on the decimal can be rounding off the decimal; it can also be rounding up, for example, the first estimated value of the number of active addresses determined by the sampling is 10001.34, the electronic device rounds up 10001.34, and determines that the number of active addresses determined by the sampling is 10002, that is, the first estimated value of the number of active addresses determined by the sampling is 10002; it can also be directly rounding down, for example, the first estimated value of the number of active addresses determined by the sampling is 10001.34, the electronic device rounds down 10001.34, and determines that the number of active addresses determined by the sampling is 10001, that is, the first estimated value of the number of active addresses determined by the sampling is 10001.

[0075] In a possible implementation, if the sampling is the first sampling, the ratio of the number of active addresses detected in the sampling to the sampling scale can be determined by the number of active addresses determined in the sampling and the sampling scale of the sampling; and based on the received network space address range to be detected, the total number N of specific addresses contained in the received network space address range to be detected can be determined; based on the product of the ratio of the number of active addresses determined in the sampling to the sampling scale and the total number N of specific addresses, the first estimated value of the number of active addresses determined in the sampling can be determined.

[0076] S104: If a first difference between the first estimated value and a second estimated value of the number of active addresses determined in a previous sampling adjacent to the current sampling is less than a preset convergence threshold, the first estimated value is determined to be the number of active addresses in the network space.

[0077] The convergence threshold refers to the critical value pre-set in the optimization algorithm or iterative process, which is used to determine whether the convergence state has been reached. Specifically, when the objective function value, parameter change or error is less than the convergence threshold, the algorithm is considered to have converged and stops running.

[0078] The electronic device first determines the first difference between the first estimated value of the number of active addresses determined by the current sampling and the second estimated value of the number of active addresses determined by the previous sampling adjacent to the current sampling; then determines whether the first difference is less than a preset convergence threshold. If so, the electronic device directly determines that the first estimated value is the number of active addresses in the network space. If not, the electronic device continues to perform the next sampling, detection, determination of the estimated value of the number of active addresses, and subsequent judgment processes. That is, until the convergence condition || X is met i |-|X i-1 When ||<ò, the first estimated value is determined to be the number of active addresses in the network space. i |The first estimate of the number of active addresses determined for this sampling, |X i-1 | is the second estimated value of the number of active addresses determined in the previous adjacent sampling, and ò is the preset convergence threshold. The preset convergence threshold can be input by the user according to actual needs.

[0079] In one possible implementation, the first estimated value can be directly determined as the number of active addresses in the cyberspace; or the average of the first estimated value and the estimated values ​​of the number of active addresses determined by all samplings before the current sampling can be determined, and the average value can be determined as the number of active addresses in the cyberspace. For example, if the current sampling is the fifth sampling, the estimated values ​​of the number of active addresses determined by the first sampling, the second sampling, the third sampling, and the fourth sampling before the current sampling, as well as the estimated value of the number of active addresses determined by the fifth sampling, can be determined; and the average of these five estimated values ​​can be taken to determine the average value as the number of active addresses in the cyberspace.

[0080] In the present application, the number of active addresses in the network space is determined by introducing a combination of random sampling and convergence thresholds, which reduces the resources required for obtaining known active IPv6 addresses for sampling detection and the time overhead of generating IPv6 addresses to be detected that are similar in structure to the active IPv6 addresses. It also avoids the problem of low accuracy in determining the number of all active IPv6 addresses in the space to be detected due to the limited number of known active IPv6 addresses or the limited number of convergence times (generation times) of the generation algorithm, thereby improving the accuracy of determining the number of active addresses in the network space.

[0081] Example 2:

[0082] In order to improve the accuracy of determining the number of active addresses in the cyberspace, after receiving the input of the range of cyberspace addresses to be detected and the sampling scale, for each sampling, before randomly extracting a sample of the cyberspace addresses to be detected of the sampling scale within the range of cyberspace addresses to be detected, this application also performs a preliminary judgment on the received sampling scale to ensure the accuracy of the subsequent determination of the number of active addresses in the cyberspace. Figure 2 A schematic diagram of a process for determining whether the number of samples actually sampled is reasonable is provided in an embodiment of the present application. The process includes the following steps:

[0083] S201: Receive input of the expected number of sampling times i and the type of the network space address to be detected.

[0084] The expected sampling number i refers to the number of samples that the user hopes to take in order to determine the number of active addresses in the cyberspace.

[0085] The type of the cyberspace address to be detected refers to the specific type of the cyberspace address within the range of the cyberspace address to be detected. The specific types of the cyberspace address include home network type, enterprise network type, educational institution network type, digital center network type, other network types, etc. In actual application, the user can determine the specific type of the cyberspace address to be detected based on the cyberspace address within the range of the cyberspace address to be detected. The expected number of sampling times i and the type of the cyberspace address to be detected are input into the electronic device together for subsequent judgment on whether the number of samples actually sampled is reasonable. When the user is unsure of the specific type of the cyberspace address within the range of the cyberspace address to be detected, the user can select other network types for input.

[0086] In a possible implementation, the user may not input the type of the network space address to be detected, in which case the electronic device directly assumes that the user has selected other network types.

[0087] S202: Obtain a percentage value corresponding to the type of the network space address to be detected.

[0088] The electronic device pre-stores the type of network space addresses to be detected, as well as the percentage of network space addresses of that type relative to the total number of network space addresses. For example, the percentage of network space addresses of home network type relative to the total number of network space addresses is 1%, the percentage of network space addresses of enterprise network type relative to the total number of network space addresses is 3%, the percentage of network space addresses of educational institution network type relative to the total number of network space addresses is 5%, the percentage of network space addresses of digital center network type relative to the total number of network space addresses is 20%, and the percentage of network space addresses of other types relative to the total number of network space addresses is 15%.

[0089] According to the type of the received network space address to be detected, the electronic device obtains the proportion value corresponding to the type of the network space address to be detected based on the pre-stored type of the network space address to be detected and the proportion value corresponding to the number of network space addresses of this type to the total number of network space addresses.

[0090] S203: Determine the number of samples expected to be collected based on the proportion of the type of the network space address to be detected and a preset threshold.

[0091] Based on the determined percentage of the type of cyberspace address to be detected and a preset threshold, the quotient of the percentage and the preset threshold is determined, and the quotient is determined as the expected number of samples to be collected, wherein the expected number of samples to be collected represents the minimum number of samples required to collect the type of cyberspace address to be detected when determining the number of active cyberspace addresses. The quotient may be an integer or a decimal. When the quotient is a decimal, the electronic device rounds the decimal. The rounding operation on the decimal may be rounding the decimal to the nearest integer or rounding it up.

[0092] S204: Determine whether the expected number of samples collected is not greater than the actual number of samples collected determined by the sampling scale and the expected number of sampling times i. If so, execute S205; if not, execute S206.

[0093] S205: Determine whether the number of samples actually sampled is reasonable and proceed with the subsequent sampling process.

[0094] Multiply the sampling scale and the expected sampling times i to obtain the number of samples actually collected for the sampling scale and the expected sampling times i, wherein the number of samples actually sampled represents the type of the cyberspace address to be detected set by the user and the number of samples the user expects to collect when determining the number of active addresses in the cyberspace.

[0095] Whether the number of samples actually sampled entered by the user is reasonable is determined by determining whether the expected number of samples determined in step 203 is not greater than the number of samples actually sampled. If the expected number of samples determined is not greater than the number of samples actually sampled, then it indicates that the type of network space address to be detected requires at least the number of samples collected when determining the number of active addresses in the network space to be detected to be less than or equal to the expected number of samples set by the user, that is, the number of samples actually sampled set by the user is reasonable, and the subsequent sampling process is performed.

[0096] S206: Prompt to re-enter the sampling scale and / or the expected sampling number i, and receive the re-entered sampling scale and / or the expected sampling number i.

[0097] If the expected number of samples is greater than the actual number of samples determined by the sampling scale and the expected sampling times i, a prompt is given to re-enter the sampling scale and / or the expected sampling times i, and the re-entered sampling scale and / or the expected sampling times i are received.

[0098] That is to say, when determining the number of active addresses in the cyberspace, the type of cyberspace address to be detected needs to collect at least a number of samples greater than the expected number of samples set by the user. That is, the actual number of samples set by the user is unreasonable, and the user needs to be prompted to re-enter the sampling scale and / or the expected number of sampling times i, and receive the re-entered sampling scale and / or the expected number of sampling times i.

[0099] In one possible implementation, when re-entering the data, the user can choose to keep the sampling scale unchanged and increase the expected sampling times i, thereby increasing the set actual number of samples sampled; or they can choose to keep the expected sampling times i unchanged and increase the sampling scale, thereby increasing the set actual number of samples sampled; or they can choose to increase both the sampling scale and the expected sampling times i, thereby increasing the set actual number of samples sampled. In other words, based on the set threshold (error requirement), the number of samples actually collected input by the user is limited to a reasonable range, and the actual sampling times are kept as close as possible to the expected sampling times input by the user, to avoid the problem of excessive sampling times leading to excessive calculation time, thereby exceeding the user's expected waiting time.

[0100] In an embodiment of the present application, by obtaining the proportion value corresponding to the type of network space address to be detected; and determining the expected number of samples to be sampled based on the proportion value of the type of network space address to be detected and a preset threshold value; by determining whether the expected number of samples to be sampled is not greater than the actual number of samples to be sampled determined by the sampling scale and the expected number of sampling times i, it is judged whether the actual number of samples collected set by the user is reasonable, thereby avoiding the problem of too many sampling times resulting in too long calculation time, thereby exceeding the user's expected waiting time.

[0101] Example 3:

[0102] In order to ensure the accuracy of determining the number of active addresses in the cyberspace, the embodiment of the present application provides a detailed description of the process of determining the expected number of samples based on the proportion of the types of cyberspace addresses to be detected and the preset threshold. Figure 3 A schematic diagram of a process for determining the desired number of samples provided in an embodiment of the present application, the process comprising the following steps:

[0103] S301: Determine the square value of the preset convergence threshold and the square value of the proportion of the type of the network space address to be detected.

[0104] According to the convergence threshold preset in step 104, the square value of the convergence threshold is determined; and the square value of the proportion of the type of the network space address to be detected is determined.

[0105] S302: Determine a first product value of the square value of the preset convergence threshold and the preset error threshold; determine the expected number of samples based on a first quotient value of the square value of the proportion of the type of network space address to be detected and the first product value.

[0106] Preset thresholds include a convergence threshold ò and an error threshold δ. The convergence threshold ò is used during the iteration process to determine whether a pre-set critical value has been reached, ensuring more accurate calculations and improving convergence efficiency. The error threshold δ is set to ensure the accuracy and reliability of calculated data and prevent erroneous decisions or analysis results caused by excessive errors. The error threshold δ is set by the user based on actual needs.

[0107] The electronic device first determines the first product value of the square value of the convergence threshold ò and the preset error threshold δ according to the square value of the convergence threshold ò and the preset error threshold δ, that is, the first product value is δò 2 According to the first quotient value of the square value of the proportion of the type L of the network space address to be detected and the first product value, that is, the first quotient value is The first quotient value Determine the number of samples you want to take.

[0108] That is, whether the expected number of samples determined in the above judgment step 203 is not greater than the actual number of samples is used to determine whether the actual number of samples input by the user is reasonable, that is, the inequality is: Where m is the input sampling scale, i is the expected number of input sampling times, L is the proportion of the type of network space address to be detected, δ is the preset error threshold, ò is the preset convergence threshold, mi is the number of samples actually sampled, is the expected number of samples.

[0109] Example 4:

[0110] In order to ensure the accuracy of determining the number of active addresses in the network space, the embodiment of the present application provides a detailed description of the process of determining the first estimated value of the number of active addresses determined by the sampling. Figure 4 This is a schematic diagram of a process for determining a first estimated value of the number of active addresses determined by the sampling according to an embodiment of the present application. The process includes the following steps:

[0111] S401: Based on the active addresses determined in the sampling and the active addresses determined before the sampling, determine the total number of the active addresses in the sampling and the active addresses determined before the sampling.

[0112] The number of active addresses determined in the sampling is added to the number of active addresses determined before the sampling to obtain the total number of active addresses determined in the sampling and before the sampling.

[0113] To ensure the accuracy of determining the number of active addresses in the cyberspace, the specific implementation process of this application in determining the total number of active addresses determined before and after the sampling is as follows:

[0114] The active addresses determined in the sampling are combined with the active addresses determined before the sampling, and duplicate active addresses are removed to determine the total number of the active addresses determined in the sampling and before the sampling.

[0115] The electronic device first merges the active addresses determined by the sampling with the active addresses determined before the sampling to obtain a merged active address set S i ; Then the merged active address set S i Only one duplicate active address is retained in the set S, and the set S is determined after removing the duplicate active addresses. i The total number of active addresses remaining in .

[0116] For example, the active address determined by this sampling is H3={a1,a 21 ,a 101}, and the active address set S2 = {a1, a2, a6, a7} determined before this sampling, where the set S2 = {a1, a2, a6, a7} is obtained based on the active addresses H1 = {a1, a2, a6} determined by the first sampling and the active addresses H2 = {a1, a2, a7} determined by the second sampling. The active addresses determined by this sampling are merged with the active addresses determined by all previous samplings, and the merged active address set is S3 = {a1, a2, a6, a7, a1, a 21 ,a 101}; Then, only one duplicate active address a1 is retained in the merged active address set S3, and the total number of active addresses remaining in the set S3 |S3| is determined to be 6.

[0117] S402: Based on all addresses in the sampling and active addresses determined before the sampling, determine the number of active addresses determined before the sampling that are located in the network space address sample to be detected in the sampling.

[0118] Based on all the addresses in the sampling and the active addresses determined before the sampling, determine the addresses in the active addresses determined before the sampling that are in the sample of network space addresses to be detected in the sampling, and determine the specific number of addresses in the active addresses determined before the sampling that are in the sample of network space addresses to be detected in the sampling. For example, all the addresses in the sampling are C3={a1,a 21 ,a 71 ,…,a 101}, the active address determined by all sampling before this sampling is S2={a1,a 21 ,a7}, then the addresses in the network space address sample to be detected in this sampling are determined to be a1 and a7. 21 , and then determine that number to be 2.

[0119] In a possible implementation, when the network space address sample to be detected does not contain the active address that has been determined before the current sampling, that is, |C i ∩S i-1 When | is 0, it indicates that there may be security risks or equipment problems in this sampling. In order to avoid affecting the accuracy of determining the number of active addresses in the cyberspace, the sample collected in this sampling is determined to be invalid, and the sample is collected again.

[0120] S403: Determine a second quotient of the total number and the number; multiply the second quotient by the sampling scale to determine a first candidate estimated value of the number of active addresses determined by the sampling; and determine a first estimated value of the number of active addresses determined by the sampling based on the first candidate estimated value.

[0121] Determine the second quotient of the total number in step 401 and the number in step 402, and then multiply the second quotient by the sampling scale to obtain the first candidate estimate of the number of active addresses determined by the sampling; that is, calculate the first candidate estimate of the number of active addresses according to the proportion, i.e. Among them, |x i | is the first candidate estimate, m is the sampling size, The first estimated value of the number of active addresses determined by the sampling is determined based on the first candidate estimated value.

[0122] In a possible implementation, the electronic device may select a coarser determination method and directly determine the first candidate estimated value as the first estimated value of the number of active addresses determined by the sampling.

[0123] Example 5:

[0124] In order to improve the accuracy and stability of determining the number of active addresses in the cyberspace, the embodiment of the present application also provides a detailed description of the process of determining the first estimated value of the number of active addresses determined by the sampling based on the first candidate estimated value. Figure 5 This is a second schematic diagram of a process for determining a first estimated value of the number of active addresses determined by the sampling according to an embodiment of the present application. The process includes the following steps:

[0125] S501: Determine a second difference between the first candidate estimated value and a second candidate estimated value of the number of active addresses determined in a previous sampling adjacent to the current sampling.

[0126] The first candidate estimated value |x determined by the sampling in the above embodiment i |The second candidate estimate of the number of active addresses determined by the previous sampling adjacent to this sampling|x i-1 | is subtracted to obtain a second difference between the first candidate estimated value and the second candidate estimated value of the number of active addresses determined in the previous sampling adjacent to the sampling, that is, the second difference is ||x i |-|x i-1 ||, wherein the second difference can be a positive number or a negative number.

[0127] S502: Determine, based on the second difference and the preset dynamically adjusted learning rate, a second product value of the second difference and the dynamically adjusted learning rate corresponding to the sampling, wherein the preset dynamically adjusted learning rate corresponding to the sampling is i is the number of times the sampling occurs.

[0128] The preset dynamically adjusted learning rate refers to the adjustment parameter set according to the number of sampling times, specifically expressed as the dynamically adjusted learning rate Among them, i is the number of times the corresponding sampling occurs, and α satisfies α∈(0,1), which is used to update the estimated value more smoothly, that is, to make the update amplitude of the later estimated value smaller, thereby reducing the error.

[0129] The second difference determined in step 501 is converted to the dynamically adjusted learning rate corresponding to the sampling. Multiply them to obtain the second product value of the second difference and the dynamically adjusted learning rate corresponding to the sampling, that is, α i *||x i |-|x i-1 ||.

[0130] S503: Determine a first estimated value of the number of active addresses determined by the sampling according to the sum of the second candidate estimated value of the adjacent previous sampling and the second product value.

[0131] The second product value α determined in the above stepi *||x i |-|x i-1 ||The second candidate estimate of the adjacent previous sampling|x i-1 | Add to obtain the sum of the second candidate estimated value of the adjacent previous sampling and the second product value. The sum is determined as the first estimated value of the number of active addresses determined by the sampling, that is, |X i |=|x i-1 |+α i *||x i |-|x i-1 ||, where i is the number of times the sample is taken, |X i |The first estimate of the number of active addresses determined for this sampling, |x i |The first candidate estimate determined for this sampling, |x i-1 |The second candidate estimate of the number of active addresses determined by the previous sampling adjacent to this sampling, α i The preset dynamically adjusted learning rate corresponding to this sampling

[0132] because So you can also |X i |=|x i-1 |+α i *||x i |-|x i-1 || means When performing iterative calculations, each calculation can be expressed as:

[0133]

[0134] For the first sampling, we choose to set |x0|=m, S0=S1, that is, So that the corresponding first candidate estimate value |x i | and the corresponding first estimate |X i That is, the active address determined by the first sampling is used as the "marked" address for "mark recapture", that is, the subsequent sampling calculation process is carried out.

[0135] In an embodiment of the present application, a first estimated value determined in response to each sampling detection is updated by using a dynamically adjusted learning rate to ensure that the update amplitude of the first estimated value gradually decreases after each sampling detection, thereby improving convergence efficiency and reducing errors. That is, the present application introduces Newton's method for iterative calculation, so that the first estimated value gradually converges to the true value, thereby improving the accuracy and stability of determining the number of active addresses in the cyberspace.

[0136] Example 6:

[0137] Figure 6 A schematic diagram of the main steps for determining the number of active addresses determined by the sampling process provided in an embodiment of the present application includes the following steps:

[0138] S601: Address range to be tested and sampling scale.

[0139] This step is the process of receiving the input of the network space address range to be detected and the sampling scale in step 101 in the above embodiment, and will not be repeated here.

[0140] S602: Randomly select m sample addresses.

[0141] This step is the process of randomly extracting a sample of the network space addresses to be detected of the sampling scale within the range of the network space addresses to be detected for each sampling in step 102 of the above embodiment, which will not be described in detail here.

[0142] S603: Mark the active addresses.

[0143] This step is the process of performing active detection on the network space address sample to be detected and determining the active address in step 102 in the above embodiment, which will not be described in detail here.

[0144] S604: Add the active address to the active address record set.

[0145] This step is the process of combining the active addresses determined for the sampling in step 401 of the above embodiment with the active addresses determined before the sampling, removing duplicate active addresses, and determining the total number of active addresses for the sampling and the active addresses determined before the sampling, which will not be repeated here.

[0146] S605: Proportionally estimate the number of active addresses X in the address range to be tested i .

[0147] This step may be steps 401 to 403 in the above embodiment 4, or may be the process from steps 501 to 503 in embodiment 5, and will not be described in detail here.

[0148] S606: According to ||X i |-|X i-1 ||<ò, determine whether the preset convergence threshold is met, if so, execute S607; if not, execute S602.

[0149] S607: Determine the number of active addresses X i .

[0150] This step is the process of determining that the first estimated value is the number of active addresses in the network space if the first difference between the first estimated value and the second estimated value of the number of active addresses determined by the previous sampling adjacent to the current sampling in step 104 of the above embodiment is less than the preset convergence threshold, and will not be repeated here.

[0151] Example 7:

[0152] Based on the same application concept, the embodiment of the present application provides a device for determining the number of active addresses in a network space. Figure 7 For a schematic diagram of a device structure for determining the number of active addresses in a network space provided in an embodiment of the present application, please refer to Figure 7 , the device comprises:

[0153] Receiving module 701, used to receive input of the network space address range to be detected and the sampling scale;

[0154] Processing module 702 is used to randomly extract a sample of the network space address to be detected of the sampling scale within the range of the network space address to be detected for each sampling; perform active detection on the sample of the network space address to be detected to determine the active address; if the sampling is not the first sampling, determine a first estimated value of the number of active addresses determined by the sampling based on the total number of active addresses determined by the sampling and all samples before the previous sampling, the sampling scale, and the number of active addresses determined by all adjacent previous samplings before the sampling that are located in the sample of the network space address to be detected by the sampling; if a first difference between the first estimated value and the second estimated value of the number of active addresses determined by the previous sampling adjacent to the sampling is less than a preset convergence threshold, determine the first estimated value as the number of active addresses in the network space.

[0155] In a possible implementation, the receiving module 701 is further configured to receive an input of an expected number of sampling times i and a type of the network space address to be detected;

[0156] The processing module 702 is also used to obtain the proportion value corresponding to the type of the network space address to be detected, and determine the expected number of samples according to the proportion value of the type of the network space address to be detected and a preset threshold; judge whether the expected number of samples is not greater than the actual number of samples collected determined by the sampling scale and the expected number of sampling times i. If so, determine that the actual number of samples is reasonable, and perform subsequent sampling process.

[0157] In one possible embodiment, the processing module 702 is also used to prompt for re-entry of the sampling scale and / or expected sampling number i if the expected number of samples is greater than the actual number of samples determined by the sampling scale and the expected sampling number i, and to receive the re-entered sampling scale and / or expected sampling number i.

[0158] In one possible implementation, the processing module 702 is specifically used to determine the square value of the preset convergence threshold and the square value of the proportion of the type of the network space address to be detected; determine the first product value of the square value of the preset convergence threshold and the preset error threshold; and determine the expected number of samples based on the first quotient value of the square value of the proportion of the type of the network space address to be detected and the first product value.

[0159] In one possible implementation, the processing module 702 is specifically configured to determine the total number of active addresses determined in the current sampling and the previous sampling that was adjacent to the current sampling based on the active addresses determined in the current sampling and the active addresses determined in the previous sampling that was adjacent to the current sampling; determine a first number of the active addresses determined in the previous sampling that was adjacent to the current sampling that are located in the network space address sample to be detected in the current sampling based on all addresses in the current sampling and the active addresses determined in the previous sampling that was adjacent to the current sampling; determine a second quotient of the total number and the first number; multiply the second quotient by the sampling scale to determine a first candidate estimated value of the number of active addresses determined in the current sampling; and determine a first estimated value of the number of active addresses determined in the current sampling based on the first candidate estimated value.

[0160] In one possible implementation, the processing module 702 is specifically configured to merge the active addresses determined by the current sampling and the active addresses determined by the previous sampling that is adjacent to the current sampling, remove duplicate active addresses, and determine the total number of active addresses determined by the current sampling and the previous sampling that is adjacent to the current sampling.

[0161] In one possible implementation, the processing module 702 is specifically configured to determine a second difference between the first candidate estimated value and a second candidate estimated value of the number of active addresses determined by a previous sampling adjacent to the sampling; and determine, based on the second difference and a preset dynamically adjusted learning rate, a second product value of the second difference and the dynamically adjusted learning rate corresponding to the sampling, wherein the preset dynamically adjusted learning rate corresponding to the sampling is i is the number of times the sampling corresponds to this time; a first estimated value of the number of active addresses determined by this sampling is determined according to the sum of the second candidate estimated value of the adjacent previous sampling and the second product value.

[0162] Example 8:

[0163] Based on the same application concept, an embodiment of the present application provides an electronic device that can implement the steps of the method for determining the number of active addresses in the network space discussed above. Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown in FIG. Figure 8 As shown, it includes: a processor 801, a communication interface 802, a memory 803 and a communication bus 804, wherein the processor 801, the communication interface 802, and the memory 803 communicate with each other through the communication bus 804;

[0164] The memory 803 stores a computer program. When the program is executed by the processor 801, the processor 801 performs the following steps:

[0165] Receive input of the network space address range to be detected and the sampling scale;

[0166] For each sampling, within the range of the network space addresses to be detected, a sample of the network space addresses to be detected of the sampling scale is randomly selected; active detection is performed on the sample of the network space addresses to be detected to determine the active addresses; if the sampling is not the first sampling, a first estimated value of the number of active addresses determined by the sampling is determined based on the total number of active addresses determined by the sampling and before the sampling, the sampling scale, and the number of active addresses determined before the sampling that are located in the sample of the network space addresses to be detected by the sampling; if a first difference between the first estimated value and a second estimated value of the number of active addresses determined by the previous sampling adjacent to the sampling is less than a preset convergence threshold, the first estimated value is determined to be the number of active addresses in the network space.

[0167] In a possible implementation, the processor 801 is further configured to receive an input of an expected number of sampling times i and a type of the network space address to be detected;

[0168] Obtaining a percentage value corresponding to the type of the network space address to be detected;

[0169] Determining the number of samples expected to be collected based on the proportion of the type of the network space address to be detected and a preset threshold;

[0170] Determine whether the expected number of samples is not greater than the actual number of samples collected determined by the sampling scale and the expected number of sampling times i. If so, determine that the actual number of samples is reasonable and proceed with the subsequent sampling process.

[0171] In one possible embodiment, the processor 801 is further used to prompt for re-entry of the sampling scale and / or expected sampling number i if the expected number of samples is greater than the actual number of samples determined by the sampling scale and the expected sampling number i, and to receive the re-entered sampling scale and / or expected sampling number i.

[0172] In a possible implementation, the processor 801 is specifically configured to determine a square value of the preset convergence threshold and a square value of a proportion of the type of the network space address to be detected;

[0173] Determine a first product value of the square value of the preset convergence threshold and the preset error threshold; determine the expected number of samples based on a first quotient value of the square value of the proportion of the type of network space address to be detected and the first product value.

[0174] In a possible implementation, the processor 801 is specifically configured to determine, based on the active addresses determined for the sampling and the active addresses determined before the sampling, a total number of active addresses for the sampling and the active addresses determined before the sampling;

[0175] Based on all addresses in the sampling and active addresses determined before the sampling, determine the number of active addresses determined before the sampling that are located in the sample of network space addresses to be detected in the sampling;

[0176] Determine a second quotient of the total number and the number; multiply the second quotient by the sampling size to determine a first candidate estimate of the number of active addresses determined by the sampling; and determine a first estimate of the number of active addresses determined by the sampling based on the first candidate estimate.

[0177] In one possible implementation, the processor 801 is specifically configured to combine the active addresses determined for the sampling with the active addresses determined before the sampling, remove duplicate active addresses, and determine the total number of active addresses for the sampling and the active addresses determined before the sampling.

[0178] In a possible implementation, the processor 801 is specifically configured to determine a second difference between the first candidate estimated value and a second candidate estimated value of the number of active addresses determined in a previous sampling adjacent to the current sampling;

[0179] According to the second difference and the preset dynamically adjusted learning rate, a second product value of the second difference and the dynamically adjusted learning rate corresponding to the sampling is determined, wherein the preset dynamically adjusted learning rate corresponding to the sampling is i is the number of times the corresponding sampling occurs;

[0180] A first estimated value of the number of active addresses determined by the sampling is determined according to the sum of the second candidate estimated value of the adjacent previous sampling and the second product value.

[0181] The communication bus mentioned in the above-mentioned electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus. The communication interface 802 is used for communication between the above-mentioned electronic device and other devices. The memory can include a random access memory (RAM) and can also include a non-volatile memory (NVM), such as at least one disk storage. Optionally, the memory can also be at least one storage device located away from the aforementioned processor.

[0182] The above-mentioned processor can be a general-purpose processor, including a central processing unit, a network processor (NP), etc.; it can also be a digital signal processing processor (DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0183] Example 11:

[0184] Based on the same application concept, embodiments of the present application provide a computer-readable storage medium storing a computer program executable by a processor. When the program is executed on the processor, the processor executes any of the methods for determining the number of active addresses in a network space discussed above. Because the principles underlying the problem solved by the computer-readable storage medium are similar to those of the method for determining the number of active addresses in a network space, the implementation of the computer-readable storage medium can be referred to as the implementation of the method, and any repetitions will not be repeated.

[0185] Based on the same application concept, embodiments of the present application further provide a computer program product, comprising: computer program code, which, when executed on a computer, causes the computer to execute any of the methods for determining the number of active addresses in a cyberspace as discussed above. Because the principles underlying the problems solved by the aforementioned computer program products are similar to those of the methods for determining the number of active addresses in a cyberspace, the implementation of the aforementioned computer program products can be referenced to the implementation of the methods, and any repetitions will not be repeated.

[0186] The present application provides a method for determining the number of active addresses in a cyberspace, which can accurately determine the total number of active addresses in the address range of the cyberspace to be detected by consuming less detection resources. In addition, the present application refers to the mark-recapture method of biological population measurement, introduces a method combining random sampling and active detection, and reduces the impact of the cyberspace addresses in the address range of the cyberspace to be detected while ensuring accuracy. The present application also introduces an iterative optimization method and a preset dynamically adjusted learning rate, so that the calculation results can converge faster, improving the stability and accuracy of the process of determining the number. The method can solve the existing problem that the number of all active IPv6 addresses in the space to be detected cannot be accurately determined due to the limited number of known active IPv6 addresses or the limited number of convergence times (generation times) of the generation algorithm, resulting in a low accuracy rate for determining the number. The method is applicable to multiple fields such as large-scale network mapping, security monitoring, and attack surface assessment, and can provide reliable data support for network management and security protection.

[0187] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0188] The computer program for performing the operation of the present disclosure can be an assembly instruction, an instruction set architecture (ISA) instruction, a machine instruction, a machine-related instruction, a microcode, a firmware instruction, a state setting data, or a source code or object code written in any combination of one or more programming languages, wherein the programming language includes an object-oriented programming language such as Smalltalk, C++, and a conventional procedural programming language such as "C" language or similar programming language. The computer readable program instruction can be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer via any type of network including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) is personalized by utilizing the state information of the computer readable program instruction, and the electronic circuit can execute the computer readable program instruction, thereby realizing various aspects of the present disclosure.

[0189] The computer program product described herein may be implemented in hardware, software, or a combination thereof. In one embodiment, the computer program product is implemented as a computer storage medium. In another embodiment, the computer program product is implemented as a software product, such as a software development kit (SDK).

[0190] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0191] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0192] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0193] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0194] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A method for determining the number of active addresses in a network space, characterized in that: The method comprises: Receive input of the network space address range to be detected and the sampling scale; For each sampling, within the range of the network space addresses to be detected, a sample of the network space addresses to be detected of the sampling scale is randomly selected; active detection is performed on the sample of the network space addresses to be detected to determine the active addresses; if the sampling is not the first sampling, a first estimated value of the number of active addresses determined by the sampling is determined based on the total number of active addresses determined by the sampling and before the sampling, the sampling scale, and the number of active addresses determined before the sampling that are located in the sample of the network space addresses to be detected by the sampling; if a first difference between the first estimated value and a second estimated value of the number of active addresses determined by the previous sampling adjacent to the sampling is less than a preset convergence threshold, the first estimated value is determined to be the number of active addresses in the network space.

2. The method according to claim 1, characterized in that After receiving the input network space address range to be detected and the sampling scale, for each sampling, before randomly extracting a sample of network space addresses to be detected of the sampling scale within the network space address range to be detected, the method further includes: Receive the expected number of sampling times i and the type of network space address to be detected as input; Obtaining a percentage value corresponding to the type of the network space address to be detected; Determining the number of samples expected to be collected based on the proportion of the type of the network space address to be detected and a preset threshold; Determine whether the expected number of samples is not greater than the actual number of samples collected determined by the sampling scale and the expected number of sampling times i. If so, determine that the actual number of samples is reasonable and proceed with the subsequent sampling process.

3. The method according to claim 2, characterized in that The method also includes: if the expected number of samples is greater than the actual number of samples determined by the sampling scale and the expected sampling times i, prompting to re-enter the sampling scale and / or expected sampling times i, and receiving the re-entered sampling scale and / or expected sampling times i.

4. The method according to claim 2, characterized in that Determining the expected number of samples based on the proportion of the type of the network space address to be detected and a preset threshold includes: Determining the square value of the preset convergence threshold and the square value of the proportion of the type of the network space address to be detected; Determine a first product value of the square value of the preset convergence threshold and the preset error threshold; determine the expected number of samples based on a first quotient value of the square value of the proportion of the type of network space address to be detected and the first product value.

5. The method according to claim 1, wherein Determining a first estimated value of the number of active addresses determined for the sampling based on the total number of active addresses determined for the sampling and prior to the sampling, the sampling scale, and the number of active addresses determined prior to the sampling that are in the sample of network space addresses to be detected for the sampling includes: Determine the total number of active addresses determined for the sampling and the active addresses determined before the sampling based on the active addresses determined for the sampling; Based on all addresses in the sampling and active addresses determined before the sampling, determine the number of active addresses determined before the sampling that are located in the sample of network space addresses to be detected in the sampling; Determine a second quotient of the total number and the number; multiply the second quotient by the sampling size to determine a first candidate estimate of the number of active addresses determined by the sampling; and determine a first estimate of the number of active addresses determined by the sampling based on the first candidate estimate.

6. The method according to claim 5, characterized in that Determining the total number of active addresses determined for the sampling and the active addresses determined before the sampling based on the active addresses determined for the sampling includes: The active addresses determined in the sampling are combined with the active addresses determined before the sampling, and duplicate active addresses are removed to determine the total number of the active addresses in the sampling and the active addresses determined before the sampling.

7. The method according to claim 5, characterized in that Determining a first estimated value of the number of active addresses determined by the sampling according to the first candidate estimated value includes: Determine a second difference between the first candidate estimated value and a second candidate estimated value of the number of active addresses determined in a previous sampling adjacent to the current sampling; According to the second difference and the preset dynamically adjusted learning rate, a second product value of the second difference and the dynamically adjusted learning rate corresponding to the sampling is determined, wherein the preset dynamically adjusted learning rate corresponding to the sampling is i is the number of times the corresponding sampling occurs; A first estimated value of the number of active addresses determined by the sampling is determined according to the sum of the second candidate estimated value of the adjacent previous sampling and the second product value.

8. A device for determining the number of active addresses in a network space, characterized in that: The device comprises: A receiving module, used to receive the input of the network space address range to be detected and the sampling scale; A processing module is configured to randomly extract, for each sampling, a sample of the network space addresses to be detected of the sampling scale within the range of the network space addresses to be detected; perform active detection on the sample of the network space addresses to be detected to determine the active addresses; if the sampling is not the first sampling, determine a first estimated value of the number of active addresses determined by the sampling based on the total number of active addresses determined by the sampling and before the sampling, the sampling scale, and the number of active addresses determined before the sampling that are located in the sample of the network space addresses to be detected by the sampling; if a first difference between the first estimated value and a second estimated value of the number of active addresses determined by the previous sampling adjacent to the sampling is less than a preset convergence threshold, determine the first estimated value to be the number of active addresses in the network space.

9. An electronic device, characterized in that: The electronic device includes a processor, and the processor is configured to implement the method according to any one of claims 1 to 7 when executing a computer program stored in a memory.

10. A computer-readable storage medium, characterized in that The device stores a computer program, which implements the method according to any one of claims 1 to 7 when executed by a processor.

Images