An efficient IPv6 address detection method based on neural network model

Abstract

The application discloses a kind of high-efficiency IPv6 address detection methods based on neural network model, belong to IPv6 address detection technical field.The method includes: step 1, collection IPv6 seed address, the IPv6 seed address is preprocessed, obtains multiple IPv6 seed address data sets;Step 2, construct neural network model, using the multiple IPv6 seed address data sets is trained to the neural network model;Using trained neural network model generates candidate IPv6 address;Step 3, to the active address detection of generated candidate IPv6 address, obtains active target IPv6 address.The method regards IPv6 address as text, trains network by self-supervised mode using seed address, with higher hit rate.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of IPv6 address detection, and particularly relates to an efficient IPv6 address detection method based on a neural network model. BACKGROUND

[0002] Network asset detection is a basic task for carrying out network security work. At present, the technology for IPv4 asset detection is very mature. For example, the port scanning tool Masscan can scan the specified ports of the entire IPv4 address space within 6 minutes. With the gradual depletion of IPv4 addresses, the use of IPv6 addresses is also more extensive. At present, the global IPv6 traffic ratio has reached 44.96%. However, due to the huge and sparse address space of IPv6, it takes millions of years to perform brute force scanning on all IPv6 addresses. In other words, it is completely impossible to scan the entire IPv6 address space under the current computing power. Therefore, it is still a technical problem to research an effective IPv6 address detection method.

[0003] For IPv4 / IPv6 dual-stack hosts, the existing technology induces the target host to actively send a request to the constructed IPv6 server by sending an SSDP (Simple Service Discovery Protocol) data packet in an IPv4 network environment, and then extracts the IPv6 address from the server log. Or through the DNS-SD protocol to enumerate the service list of the target host and the corresponding AAAA record to obtain the IPv6 address of the target host. This method discovers a small number of IPv6 addresses.

[0004] The existing technology also includes generating a set of predicted candidate addresses that may be alive from a set of seed addresses, and then performing liveliness detection on these candidate target addresses to obtain effective target addresses. These methods can be divided into the following four categories.

[0005] (1) Based on address entropy, for example, the Entropy / IP method mines the IPv6 address structure implied in a set of IPv6 addresses through entropy value to generate predicted addresses, but the hit rate of these addresses is low.

[0006] (2) Based on address density: For example, based on the assumption that the area with dense seed addresses is more likely to contain other active hosts, high-density areas are formed by clustering similar seeds, thereby generating target addresses with high hit rates. Or by building a spatial tree through the Dual-debiased Heterogeneous Co-training (DHC) algorithm, the characteristics of the seed address distribution are revealed, and the search direction is dynamically adjusted according to real-time scanning feedback, and the area with dense active addresses is preferentially scanned. One IPv6 address pattern mining method based on graph theory 6Graph extracts high-density address patterns through improved hierarchical clustering algorithm and density-optimized minimum spanning tree (MST) clustering algorithm. These methods rely too much on seed addresses, and the generated target addresses lack diversity.

[0007] (3) Based on reinforcement learning, for example, the Internet IPv6 scanning method 6Sense combines reinforcement learning with online scanning: through iterative optimization to generate candidate IPv6 addresses, the scanning range is narrowed. A comprehensive global active IPv6 address discovery system AddrMiner divides the IPv6 address space into seed-free areas (AddrMiner-N), areas with few seeds (AddrMiner-F), and areas with abundant seeds (AddrMiner-S). For areas with abundant seeds, the address generation direction is dynamically adjusted through reinforcement learning to optimize the detection efficiency of high-density areas.

[0008] (4) Based on deep learning, for example, the gated convolutional variational autoencoder for IPv6 target generation 6GCVAE learns the seed address distribution through gated convolutional layers to form hidden space parameters, and generates new predicted addresses from the hidden space.

[0009] The above existing technologies generate a certain number of new predicted addresses by analyzing the address entropy, structural features or address density distribution of a certain number of known IPv6 seed addresses, and then perform active detection on these generated addresses to find hidden IPv6 addresses. However, these target address generation algorithms (TGA) usually have low address generation efficiency and low hit rate. SUMMARY

[0010] The technical problem to be solved by the present application is to overcome the shortcomings of the prior art and provide an efficient IPv6 address detection method based on a neural network model.

[0011] To solve the above technical problems, the present application discloses an efficient IPv6 address detection method based on a neural network model, comprising the following steps:

[0012] Step 1, collect IPv6 seed addresses, preprocess the IPv6 seed addresses to obtain a plurality of IPv6 seed address data sets;

[0013] Step 2, construct a neural network model, train the neural network model using the plurality of IPv6 seed address data sets; generate a candidate IPv6 address using the trained neural network model;

[0014] Step 3, perform active address detection on the generated candidate IPv6 address to obtain an active target IPv6 address.

[0015] Further, step 1 comprises:

[0016] Performing activity detection on the collected IPv6 seed addresses to obtain responsive active IPv6 seed addresses;

[0017] Down-sampling the active IPv6 seed addresses to obtain a plurality of IPv6 seed address sets with different sampling quantities;

[0018] Expanding each IPv6 seed address in each IPv6 seed address set, removing colons, adding a start identifier and an end identifier at the beginning and end of the IPv6 seed address respectively, obtaining a string, converting each character of the string to an integer identifier, obtaining an IPv6 seed address data vector, and further obtaining a plurality of IPv6 seed address data sets.

[0019] Further, the neural network model in step 2 comprises an embedding layer, N decoder layers, a linear output layer and a normalization layer, The embedding layer is used to convert the IPv6 seed address data vector in the IPv6 seed address data set into an IPv6 seed address two-dimensional tensor;

[0020] The decoder layer is used to extract hierarchical features of the embedding layer output sequence during training and to generate the target address sequence autoregressively (bit by bit) during inference;

[0021] The linear output layer is used to map the high-dimensional vector output by the decoder to the same dimension as the size of the IPv6 address coding dictionary;

[0022] The normalization layer is used to convert the linear layer output into the occurrence probability of each character on the IPv6 address coding dictionary, and then randomly select a character as output with probability as weight from the top_k characters with the highest probability, .

[0023] Further, the decoder layer in step 2 comprises two identical multi-head attention layers with mask and one feedforward network layer, and the layers are connected by residual connection and layer normalization, and the activation function of each layer is Gelu.

[0024] The input and output dimensions of the multi-head attention layer with mask are both the model width, and the input and output dimensions of the feedforward network layer are both the model width.

[0025] Further, each bit of the output vector of the linear output layer in step 2 corresponds to a character in the IPv6 address encoding dictionary; during model training, the output of the linear output layer is directly used to calculate the cross-entropy loss with the target data, so as to adjust the model parameters; during the inference stage, the output of the linear output layer also needs to be processed in combination with the normalization layer to generate a candidate IPv6 address.

[0026] Further, the normalization layer in step 2 converts the output vector of the linear output layer into a probability distribution corresponding to the probability of occurrence of each character in the IPv6 address encoding dictionary during the inference stage, and controls the output probability distribution through a temperature parameter T, and randomly selects one as a generated character from the top_k characters with the largest probability as a generated character, and generates a candidate IPv6 address.

[0027] Further, the training of the neural network model in step 2 comprises: using a self-supervised training mode to train multiple IPv6 seed address data sets respectively; without manual annotation of data, the target data is generated by the IPv6 seed address data itself; the model loss function is selected as cross-entropy loss, and the optimizer is selected as Adam, and the learning rate is adjusted adaptively, and the first and second moments of the gradient are used for parameter updating.

[0028] Further, the use of the trained neural network model in step 2 to generate a candidate IPv6 address comprises:

[0029] The IPv6 address is calculated bit by bit to generate an initial candidate IPv6 address.

[0030] The initial candidate IPv6 address is de-duplicated to obtain a final candidate IPv6 address.

[0031] Further, step 3 removes the addresses that are duplicated with the IPv6 seed address and the addresses with an alias prefix from the final candidate IPv6 address before performing active address detection on the generated candidate IPv6 address.

[0032] Further, the model width, the number of decoder layers N, and the internal dimension d ffThe attention tap number h, the discard rate, the normalization layer temperature parameter, and top_k are all hyperparameters, which are adjusted according to the actual situation of the training data set.

[0033] Advantages:

[0034] The application provides an efficient IPv6 address detection method based on a neural network model. The neural network model is constructed, the IPv6 address is regarded as text, the network is trained in a self-supervised manner through a seed address, 1M to 10M candidate addresses are generated on a 10K, 100K and 1M size seed set, the detection hit rate is 56% to 74%, and the detection hit rate is 1.1 to 292 times that of other methods. In the future, the seed address can be manually labeled with an address mode or a field, the network model can generate a desired address mode or IPv6 address in a certain field, and further services can be provided for network security research. BRIEF DESCRIPTION OF DRAWINGS

[0035] The application will be described in further detail below with reference to the drawings and specific embodiments, and the advantages of the above and / or other aspects of the application will become more apparent.

[0036] Figure 1 A flowchart of an efficient IPv6 address detection method based on a neural network model is provided for the embodiments of the application.

[0037] Figure 2 A neural network model structure diagram of an efficient IPv6 address detection method based on a neural network model is provided for the embodiments of the application.

[0038] Figure 3 A decoder layer internal structure diagram of a neural network model of an efficient IPv6 address detection method based on a neural network model is provided for the embodiments of the application.

[0039] Figure 4 A curve of the active rate of IPv6 addresses in a data set used when experiment evaluation is performed on an efficient IPv6 address detection method based on a neural network model is provided for the embodiments of the application.

[0040] Figure 5 A bar chart of the proportion of the top 10 autonomous systems in data when experiment evaluation is performed on an efficient IPv6 address detection method based on a neural network model is provided for the embodiments of the application.

[0041] Figure 6 A bar chart of the proportion of the top 10 network prefixes in data when experiment evaluation is performed on an efficient IPv6 address detection method based on a neural network model is provided for the embodiments of the application.

[0042] Figure 7 The hit rate of the generated candidate address when the seed address data set S1-S3 is used in different hierarchical models during experimental evaluation of the high-efficiency IPv6 address detection method based on the neural network model provided in the embodiments of the present application.

[0043] Figure 8 The hit rate of the generated candidate address when the seed address data set S1-S3 is used in different model dimensions during experimental evaluation of the high-efficiency IPv6 address detection method based on the neural network model provided in the embodiments of the present application.

[0044] Figure 9 The hit rate of the generated candidate address when the seed address data set S1-S3 is used in different model feedforward network hidden layer dimensions during experimental evaluation of the high-efficiency IPv6 address detection method based on the neural network model provided in the embodiments of the present application.

[0045] Figure 10 The hit rate of the generated candidate address when the seed address data set S1-S3 is used in different model attention tap numbers during experimental evaluation of the high-efficiency IPv6 address detection method based on the neural network model provided in the embodiments of the present application.

[0046] Figure 11 The hit rate of the generated candidate address when the seed address data set S1-S3 is used in different dropout rate models during experimental evaluation of the high-efficiency IPv6 address detection method based on the neural network model provided in the embodiments of the present application.

[0047] Figure 12 The hit rate of the generated candidate address when the seed address data set S1-S3 is used in different temperatures during experimental evaluation of the high-efficiency IPv6 address detection method based on the neural network model provided in the embodiments of the present application.

[0048] Figure 13 The hit rate of the generated candidate address when the seed address data set S1-S3 is used in different top_k during experimental evaluation of the high-efficiency IPv6 address detection method based on the neural network model provided in the embodiments of the present application.

[0049] Figure 14 The hit rate of the generated candidate address when the seed address data set S1-S3 is used in different top_k during experimental evaluation of the high-efficiency IPv6 address detection method based on the neural network model provided in the embodiments of the present application.

[0050] Figure 15 The pseudocode diagram of generating a candidate IPv6 address in the high-efficiency IPv6 address detection method based on the neural network model provided in the embodiments of the present application. DETAILED DESCRIPTION

[0051] Embodiments of the present application will be described below with reference to the accompanying drawings.

[0052] An IPv6 address is 128 bits long and is generally represented by 32 hexadecimal characters separated by a colon. The type of IPv6 address is identified by the high bits of the address, and is divided into: unspecified address:: / 128, loopback address::1 / 128, multicast address FF00:: / 8, link-local address FE80:: / 10, and global unicast address 2000:: / 3. Current IPv6 address detection techniques are all researches on global unicast addresses.

[0053] An IPv6 address is allocated by the Internet Assigned Numbers Authority (IANA) in a hierarchical manner, and the IPv6 address segment allocated to a user by an operator is generally / 64 bits. The low 64 bits are called an interface identifier (IID), which is self-addressed by the user. The IID can be randomly generated, EUI-64 encoded, or manually configured, and manual configuration includes using a low byte address, embedding an IPv4 address, embedding a service port, and embedding a character. By analyzing the encoding of the IPv6 address, the address scanning space can be greatly reduced, thereby providing an IPv6 address scanning method. However, this method may not be effective for randomly generated and complex manually configured addresses.

[0054] Embodiments of the present application disclose an efficient IPv6 address detection method based on a neural network model, as shown in Figure 1 The method comprises the following steps:

[0055] Step 1: Collecting IPv6 seed addresses, preprocessing the IPv6 seed addresses, and obtaining a plurality of IPv6 seed address data sets, specifically including:

[0056] Performing active detection on the collected IPv6 seed addresses to obtain active IPv6 seed addresses that respond;

[0057] Down-sampling the active IPv6 seed addresses to obtain a plurality of IPv6 seed address sets with different sampling quantities;

[0058] Expanding each IPv6 seed address in each IPv6 seed address set, removing the colon, adding a start identifier and an end identifier at the beginning and end of the IPv6 seed address respectively, obtaining a string, converting each character of the string into an integer identifier, obtaining an IPv6 seed address data vector, and further obtaining a plurality of IPv6 seed address data sets.

[0059] Step 2, constructing a neural network model, training the neural network model using the plurality of IPv6 seed address data sets; generating a candidate IPv6 address using the trained neural network model;

[0060] The neural network model comprises an embedding layer, N decoder layers, a linear output layer, and a normalization layer (Softmax), , as shown in the model structure Figure 2 The embedding layer is used to convert the IPv6 seed address data vector in the IPv6 seed address data set into an IPv6 seed address two-dimensional tensor.

[0061] The decoder layer is used to extract hierarchical features of the embedding layer output sequence during training and to generate the target address sequence autoregressively during inference.

[0062] The linear output layer is used to map the high-dimensional vector output by the decoder to a dimension equal to the size of the IPv6 address encoding dictionary.

[0063] The normalization layer is used to convert the linear layer output into the probability of each character on the IPv6 address encoding dictionary, and then randomly select a character as the output with probability as the weight among the top_k characters with the highest probability. .

[0064] Compared with the classic Transformer, the neural network model of the embodiment has the following optimizations:

[0065] (1) IPv6 address generation is a text generation task, and the Transformer encoder has little effect. The embodiment removes the encoder, reduces the model parameter quantity, improves the algorithm efficiency, and the IPv6 address generation effect is better. Taking the number of decoder layers N = 6, the model width d model = 512, and the internal dimension d ff of the feedforward network of the decoder layer as an example, the model parameter quantity is reduced from 44M to 25M.

[0066] (2) IPv6 address can be regarded as 32 characters, and the text length is relatively short. Therefore, the embodiment removes the positional encoder, further optimizes the model, and shortens the model training and generation time.

[0067] According to the RFC5952 standard, the IPv6 address is represented by a colon-separated notation, and the intermediate continuous 0 can be compressed, so the IPv6 address needs to be encoded before being input into the neural network model. Taking the IPv6 address 2620:0:ccc::2 of OpenDNS as an example, it is expanded to 2620:0000:0ccc:0000:0000:0000:0000:0002, and the colon is removed and a starting identifier <bos>and end markers <eos>becomes <bos>262000000ccc00000000000000000002 <eos>After converting these strings to integer identifiers (IDs) and transforming them into a vector [16, 2, 6, 2, 0, 0, 0, 0, 0, 0, 12, 12, 12, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 17], where <bos> , <eos>are denoted by 16, 17, respectively.

[0068] The size of the embedding layer dictionary is 18, i.e. characters 0-9, a-f and <bos>and <eos>, the embedding dimension needs to be consistent with the model width d model A one-dimensional vector of length (34,) is converted into a two-dimensional tensor of size (34, d model ) after the embedding layer, which can be input into the model for further processing.

[0069] The decoder layer is as shown in Figure 3 Each decoder component contains two identical masked multi-head attention layers and a feed forward network layer, with residual connection (Add) and layer normalization (Norm) between layers. The activation function of each layer is Gelu, which can improve the model effect.

[0070] The input and output dimensions of the multi-head attention layer are d model . The feed forward network layer is actually two linear layers in series, with input and output dimensions of (d model , d ff ) and (d ff , d model ), respectively. Therefore, the input and output dimensions of the feed forward network are still d model .

[0071] In this embodiment, the width of the entire neural network model is d model , and the dictionary size of the IPv6 address encoding is only 18, so a linear output layer is needed for conversion, with each bit corresponding to each character in the dictionary. During model training, the output of the linear output layer is directly calculated with the target data to calculate the cross-entropy loss, to adjust the model parameters; and in the inference stage, the linear output layer output also needs to be combined with the Softmax layer for one-step processing to generate candidate addresses.

[0072] The normalization layer converts the output vector of the linear output layer into a probability distribution corresponding to the probability of each character in the dictionary appearing, controls the output probability distribution through the temperature parameter T, and then randomly selects one as the generated character with the probability as the weight, to generate a candidate IPv6 address. . . The larger the value, the richer the generated target address; The smaller the value, the more repeated the generated target address will be. When , it is a greedy algorithm, and the generated target address is only one.

[0073] The training of the neural network model by using the plurality of IPv6 seed address data sets in step 2 comprises: training the plurality of IPv6 seed address data sets respectively in a self-supervised training mode; without manual labeling of data, the target data is generated by the seed IPv6 address data itself, for example, for an IPv6 address data 240e:06a0:0010:012e:0000:0001:0000:0001, after processing, the training data input to the model is <bos>240e06a00010012e0000000100000001, and the automatically generated target data is 240e06a00010012e0000000100000001 <eos>The model loss function is cross-entropy loss, and the optimizer is Adam, which adjusts the learning rate adaptively and updates the parameters by using the first moment (mean) and second moment (variance) of the gradient.

[0074] During the training of the model, the cross-entropy loss between the linear output layer output of the model and the target data is calculated, and the model parameters are adjusted according to the error. After multiple rounds of training iterations, the neural network is finally trained as a model that can generate IPv6 addresses.

[0075] The step 2 uses the trained neural network model to generate candidate IPv6 addresses, which includes:

[0076] The initial candidate IPv6 address is generated by calculating the IPv6 address bit by bit.

[0077] The initial candidate IPv6 address is de-duplicated to obtain the final candidate IPv6 address.

[0078] During the training of the model, an IPv6 address data is calculated once, while IPv6 address generation is different, it is generated by calculating bit by bit in an autoregressive manner, that is, generating an IPv6 address, the model needs to calculate 31 times.

[0079] According to RFC 4291, the IPv6 global unicast address range is 2000:: / 3, that is, all IPv6 global unicast addresses start with 2 or 3, but the actual collected IPv6 addresses are all started with 2, therefore, in the generation of IPv6 prediction address, the subsequent characters are generated bit by bit starting with 2, and the steps are as follows:

[0080] (1) The <bos>2 Input to the model, assuming the softmax output of this step is x0 (x represents any character), the last bit of the output is cut off and spliced to the input to get <bos>20;

[0081] (2) to <bos>20 Input to model, assume the softmax output of this step is xx0, the last digit of the output is cut off and spliced to the input to get <bos>200;

[0082] (3) Repeat the above steps until 31 characters are generated, and the last bit of the softmax output is cut off and spliced into the input, assuming that the result is <bos>200 14c480 200 e3000000000000000001, remove start marker <bos>and add a colon separator, which is the generated IPv6 address 2001:4c48:0200:e300:0000:0000:0000:0001.

[0083] The generation of candidate addresses has a certain randomness, so the generated addresses may be repeated. In order to remove the generated target addresses, an ordered set data type OrderedSet is used in this embodiment, which can not only remove the generated addresses, but also maintain the order of the generated addresses, which is convenient for verifying the index difference of the generated addresses. The pseudo code for generating candidate addresses is as shown in Figure 15

[0084] Step 3: Active address detection is performed on the generated candidate IPv6 address to obtain the active target IPv6 address.

[0085] In this embodiment, due to the characteristics of the generated neural network model, the generated IPv6 address will inevitably have duplicate addresses with the seed and may have aliased prefixes. Therefore, before performing the activity detection, the addresses with the seed must be removed, and then the aliased prefixes collected by the prior art are used to match and remove the aliased prefix addresses.

[0086] In the active address detection, the IPv6 addresses responding to TCP and UDP protocols will mostly respond to the ICMPv6 protocol. Therefore, in order to reduce the number of probe packets and reduce the impact of address scanning on the network, the ICMPv6 protocol can be used to detect the activity of the address, and the zmap tool with IPv6 function is used for scanning. The control probe packet rate is 20k pps, and the average sending rate is about 15M bps.

[0087] The experimental environment of this embodiment is a CentOS 7.9 server with 2 Intel(R) Xeon(R) Silver 4210 CPUs (2.20GHz), 128GB of memory, and 1 NVIDIA A10 GPU.

[0088] The IPv6 seed address used in the experiment is derived from the active address after removing the aliased prefix collected by Gasser. This data set was published on February 22, 2025, and there are a total of 43.28M addresses. Since the activity of IP addresses has different spatiotemporal characteristics, the results of detecting the same IP address at different times and different addresses may be completely different. Therefore, before the experiment, the seed address was first detected for activity, and only the active IPv6 seed address that responded was retained for the experiment.

[0089] ​After ICMPv6 protocol data detection, the dataset has a total of 18.62M active IPv6 addresses. Long-term ICMPv6 protocol detection of the dataset found that the hit rate of the seed address gradually decreased over time, as shown in Figure 4 .

[0090] The PyASN tool was also used to analyze the proportion of network prefixes and autonomous systems in the data. Among the 18.62M active IPv6 addresses, there are 61.41K network prefixes (BGP prefix) and 20.29K autonomous systems (AS, Autonomous System). The address proportion is extremely uneven, with the address proportion of the Top 4 ASes exceeding 50%; the network prefix proportion is relatively uniform, with the address proportion of the Top 12 Prefixes exceeding 50%. Figure 5 and Figure 6 show the proportion of the Top 10 ASes and BPG Prefixes, respectively.

[0091] To compare the uniformity of network prefix and autonomous system distribution in IPv6 address sets of different sizes, this embodiment proposes a formula for calculating the uniformity U similar to entropy:

[0092]

[0093] where n represents the total number of addresses in the dataset, not the number of network prefixes (or autonomous systems), p i represents the address proportion of each network prefix (or autonomous system), and the uniformity value is between [0, 1]. The larger the U value, the more uniform the distribution. When there is only one network prefix (or autonomous system) in the address set, the U=0 value is the smallest; when the number of addresses in the dataset is equal to the number of network prefixes (or autonomous systems), the U=1 value is the largest.

[0094] According to the above formula, the network prefix uniformity U prefix of the active addresses in the dataset is 0.30, and the autonomous system uniformity U asn is 0.23. Therefore, the uniformity of the network prefix in the dataset is slightly higher than that of the autonomous system.

[0095] To analyze the impact of different numbers of seed addresses on the target generation algorithm, the dataset was down sampled, and three address sets of 10K, 100K, and 1M were collected, namely S1, S2, and S3. As shown in Table 1, with the increasing number of samples, the distribution of AS and Prefix tends to approach the dataset.

[0096] Table 1 Seed set characteristics

[0097]

[0098] In the neural network model of the embodiment, the model width d model , the number of decoder layers N, the internal dimension d ff of the feedforward network, the number of attention taps h, the dropout rate P dropt , the Softmax temperature T, and top_k are hyperparameters that need to be adjusted according to the actual situation of the training data set. The default hyperparameters are N = 6, d model = 512, d ff = 2048, h = 6, P drop = 0.1, T = 1, and top_k = 5.

[0099] In the training process of the neural network model of the embodiment, the stochastic gradient descent algorithm (SGD) is used to update the parameters, and the learning rate and batch size are two important parameters that affect the convergence of the model. In this experiment, the training parameters are batch_size = 64 and learning_rate = 5e-5.

[0100] In the field of deep learning, the total number of gradient updates (num_updates = epochs × (training_set_size / batch_size)) is kept the same to maintain the equivalent training effect. Since the data sizes of S1, S2, and S3 are different, the number of training epochs (epoch) needs to be increased for small data sets. After simple experiments, the training epochs for S1, S2, and S3 are selected as 200, 160, and 30, respectively. During the training process, 10 intermediate results are kept, and 100K candidate addresses are generated each time to verify the model effect, mainly to evaluate the hit rate index. After removing the duplicate addresses and alias addresses from the generated candidate address set C, active probing is performed to obtain the active target address set T. Then, the hit rate is defined as the ratio of the number of active addresses to the number of candidate addresses, as shown in the following formula:

[0101] .

[0102] Obviously, the hit rate is affected by the address repetition rate and the proportion of alias addresses. The larger the address repetition rate and the proportion of alias addresses, the lower the hit rate. The larger the hit rate, the higher the effect of generating target addresses.

[0103] 1. The number of decoder layers N in the neural network model of the embodiment

[0104] In order to verify how many layers of the model can have better effect, N = [1, 3, 6, 9, 12] is set to perform experiments on the S1, S2, S3 three seed address data sets respectively, and the hit rate of the generated candidate addresses of different models is compared, and the results are shown in Figure 7 The horizontal axis in the figure is the training epoch, and the vertical axis is the hit rate. Through the above experiments, it can be found that the model with one decoder layer is too simple to learn the rules of IPv6 addresses in the data set, and the model is in an under-fitting state. With the increase of the number of decoder layers in the model, the model becomes more complex, and it needs to match the number of data. For the data set S1, when epoch > 100, the model is over-fitted, not only the hit rate is reduced, but also the self-repetition rate of the generated address is increased, resulting in the time of generating candidate addresses is longer, especially for the 9-layer and 12-layer models in the later training period, the address generation time is too long and is artificially interrupted. From the experimental data, for the S1, S2, S3 three data sets, the model with 6 decoder layers is the most suitable.

[0105] 2. The model width d of the neural network model of the embodiment model Experiment

[0106] In this experiment, the influence of model dimension on model performance is further verified, and d model = [128, 256, 512, 1024, 2048] is set to perform experiments respectively, and the hit rate of the generated candidate addresses of different models is compared, and the results are shown in Figure 8 For the S1 and S2 address sets with less data, too large d model will cause the model to overfit, and for these two data sets, d model = 256 is selected; for the S3 data set with large data, d model = 512 is selected, and the hit rate is higher.

[0107] 3. The internal dimension d of the feedforward network of the decoder layer in the neural network model of the embodiment ff Experiment

[0108] This experiment tests the influence of the hidden layer dimension d ff of the feedforward network of the model on the model performance. For the S1, S2, S3 data sets, the model width d model parameter is set to 256, 256, and 512 respectively, and the best d ff parameter is searched in [512, 1024, 2048, 4096, 8192]. The experimental results are shown in Figure 9 Different d ff The parameter has little effect on the performance of the model. For the S1, S2, and S3 data sets, the hit rate is relatively flat with respect to the d ff The parameters are 512, 512, and 2048.

[0109] 4. Attention head number h experiment

[0110] The number of attention heads of the model does not change the total number of parameters of the model, but the way of calculating attention is different. The more the number of heads, the more complex the model calculation, so it will have a certain impact on the performance of the model. Based on the previous experiment, N, d model , and d ff are set to 512, 512, and 2048, respectively, to further verify the effect of the number of attention heads on the performance of the model. The results are shown in Figure 10 . Obviously, when the number of seed addresses is small, the number of attention heads has little effect on the performance of the model. As the amount of training data increases, the number of attention heads has a more obvious effect on the performance of the model. For the S1 data set, h = 4 has the best hit rate, and for the S2 and S3 data sets, h = 8 has the most stable hit rate.

[0111] 5. Dropout rate P drop Experiment

[0112] During the training of the network model, Dropout is a commonly used regularization technique, mainly used to prevent neural network overfitting and improve the generalization ability of the model. In order to verify how large the dropout probability is more suitable for the S1, S2, and S3 seed sets, P drop = [0, 0.05, 0.1, 0.15, 0.2, 0.25, 0.3] are set to test on the three data sets, and other hyperparameters are set to the optimal values according to the previous experiment. The experimental results are shown in Figure 11 . Similarly, for the seed set with less data, the size of the dropout rate has little effect on the model; as the amount of data grows, the effect on the performance of the model becomes more obvious. For the three data sets, P drop = 0.05 is optimal.

[0113] 6. Normalization layer temperature T experiment

[0114] The normalization layer temperature (Softmax Temperature) is a hyperparameter used to adjust the smoothness of the probability distribution, mainly used to control the "confidence" or "diversity" of the model output. For high temperature parameters, the probability difference between different categories decreases, and the model is less certain about the prediction result, i.e., the output diversity increases; for low temperature parameters, the probability difference between different categories increases, and the probability distribution is more "concentrated", and the model is more certain about the prediction result. To verify the influence of temperature on the performance of the model, with the optimal hyperparameters of the previous experiment, set T = [0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 1.0] to test on three datasets respectively, generate 10M candidate addresses, and the experimental results are shown in Figure 12 The horizontal axis is the budget (the number of generated candidate addresses) in M, and the vertical axis is the hit rate. It can be seen that the normalization layer temperature is crucial to the performance of the model, when the number of generated addresses is small, the lower T, the higher the hit rate of the generated candidate addresses; but when the number of generated addresses is large, the hit rate of low T will quickly decrease, and because the diversity of low T is also low, the repetition rate of generated addresses increases, i.e., the time to generate non-repeating addresses will increase (see Table 2). For budget = 10M, on S1, S2, S3 three address sets, T = 0.5 is a good choice to balance the hit rate and generation time.

[0115] Table 2 Time (hours: minutes: seconds) of generating 10M candidate addresses under different temperatures

[0116]

[0117] 7. Parameter top_k experiment

[0118] top_k usually controls the diversity of the model output together with the normalization layer temperature, the larger the top_k, the more tokens are likely to be selected, the randomness of the generated address is greater, and the diversity of the address is more abundant; on the contrary, the smaller the top_k, the fewer tokens are selected, the certainty of the generated address increases, the repetition rate of the address increases, and the time to generate a specified number of non-repeating addresses also increases. This experiment uses the optimal model parameters trained on the above S1, S2, S3 three seed set experiments, to generate 10M addresses with top_k = [7, 9, 11, 13, 15, 16], and the results are shown in Figure 13 top_k is not the smaller the hit rate is higher, the experiment found that top_k = 16 is optimal for S1, S2, S3 three seed sets, with the highest average hit rate.

[0119] To verify the performance of the method proposed in this embodiment, the optimal parameters obtained in the above experiment (see Table 3) are compared with the 5 methods of Entropy / IP, 6GCVAE, 6Graph, 6Sense and Addriner-S, wherein 6Graph only generates target addresses that differ from the seed addresses by 1 Hamming distance, resulting in too small number of generated target addresses, this experiment improves the 6Graph method, and generates target addresses with a Hamming distance of 1 first, and if the number of addresses is not enough, generates target addresses with a Hamming distance of 2, 3, …; 6Sense may not achieve the effect described in the paper due to different running environments; Addriner-S is the address generation method of Addriner with sufficient seed addresses. 6VecLM and 6GAN are not included in the comparison because of too long running time.

[0120] Table 3 Optimal hyperparameters of the model proposed in this embodiment

[0121]

[0122] Figure 14 The hit rate of the candidate addresses generated by different methods on address sets S1-S3 after removing duplicate addresses with the seed and addresses with different prefixes is obtained through ICMPv6 protocol detection, and it is obvious that the hit rate of most methods increases with the increase of the number of seed addresses, and decreases with the increase of the number of generated candidate addresses. Among the 6 methods, the hit rate of the method proposed in this embodiment is higher than that of the other methods, and the hit rate of the candidate addresses generated on S1-S3 three seed sets is 56%-74%.

[0123] The effective IPv6 address detection method based on a neural network model proposed in this embodiment regards IPv6 addresses as text, and trains the network through self-supervised mode with seed addresses. Compared with existing methods, the method has higher hit rate. In the future, the seed addresses can be manually labeled with address patterns or domains, and the network model can generate the desired address patterns or IPv6 addresses in certain domains, further serving the research of network security.

[0124] In the specific implementation, the present application provides a computer storage medium and a corresponding data processing unit, wherein the computer storage medium can store a computer program, and the computer program can run the invention content of the efficient IPv6 address detection method based on a neural network model and part or all steps in each embodiment when executed by the data processing unit. The storage medium can be a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM), etc.

[0125] Those skilled in the art can clearly understand that the technical solutions in the embodiments of the present application can be realized by means of a computer program and a corresponding general hardware platform. Based on such understanding, the technical solutions in the embodiments of the present application can be embodied in the form of a computer program, i.e., a software product, which can be stored in a storage medium, including a plurality of instructions for causing a device (which can be a personal computer, a server, a single-chip microcomputer, a MUU or a network device, etc.) comprising a data processing unit to execute the method described in each embodiment or some parts of the embodiments of the present application.

[0126] The present application provides a kind of high efficiency IPv6 address detection method based on neural network model, the method and approach of specifically realizing this technical solution are many, above-mentioned only is the preferred embodiment of the present application, it should be pointed out, for the ordinary skilled in the art, on the premise of not departing from the principle of the present application, can also make a number of improvements and refinements, these improvements and refinements also should be considered as the protection scope of the present application. The components not explicitly described in the embodiments can be realized by existing technology.< / bos> < / bos> < / bos> < / bos> < / bos> < / bos> < / eos> < / bos> < / eos> < / bos> < / eos> < / bos> < / eos> < / bos> < / eos> < / bos>

Claims

1. An efficient IPv6 address probing method based on a neural network model, characterized in that, The method comprises the following steps: Step 1: collecting IPv6 seed addresses, preprocessing the IPv6 seed addresses to obtain a plurality of IPv6 seed address data sets; Step 2: constructing a neural network model, training the neural network model using the plurality of IPv6 seed address data sets; and generating a candidate IPv6 address using the trained neural network model; Step 3: performing active address detection on the generated candidate IPv6 address to obtain an active target IPv6 address; The neural network model described in step 2 includes an embedding layer, N decoder layers, a linear output layer, and a normalization layer, The embedding layer is configured to convert an IPv6 seed address data vector in an IPv6 seed address data set into an IPv6 seed address two-dimensional tensor. The decoder layer is used to extract hierarchical features of the embedding layer output sequence during training and to generate the target address sequence autoregressively during inference; The linear output layer is used to map the high-dimensional vector output by the decoder to a dimension equal to the size of the IPv6 address encoding dictionary; The normalization layer is used to convert the linear layer output into the probability of occurrence of each character on the IPv6 address encoding dictionary, and then randomly select a character as the output in the first top_k .​ 2.The efficient IPv6 address detection method based on a neural network model according to claim 1, wherein, Step 1 comprises: Performing active detection on the collected IPv6 seed addresses to obtain responsive active IPv6 seed addresses; Downsampling the active IPv6 seed addresses to obtain a plurality of IPv6 seed address sets with different sampling quantities; Expanding each IPv6 seed address in each IPv6 seed address set, removing colons, adding a start identifier at the beginning of the IPv6 seed address and an end identifier at the end of the IPv6 seed address to obtain a string, converting each character of the string to an integer identifier to obtain an IPv6 seed address data vector, and further obtaining a plurality of IPv6 seed address data sets. 3.The efficient IPv6 address detection method based on neural network model according to claim 2, wherein, The decoder layer in step 2 comprises two identical masked multi-head attention layers and a feedforward network layer, and residual connections and layer normalization are performed between layers, with the activation function of each layer being Gelu; The input and output dimensions of the masked multi-head attention layer are both the model width, and the input and output dimensions of the feedforward network layer are both the model width.

4. The efficient IPv6 address probing method based on a neural network model according to claim 3, characterized in that, In step 2, each bit of the output vector of the linear output layer corresponds to a character in the IPv6 address encoding dictionary; during model training, the output of the linear output layer directly calculates the cross-entropy loss with the target data to adjust the model parameters; during the inference stage, the output of the linear output layer also needs to be processed in combination with the normalization layer to generate a candidate IPv6 address.

5. The efficient IPv6 address probing method based on a neural network model according to claim 4, characterized in that, The normalization layer described in step 2 converts the output vector of the linear output layer into a probability distribution corresponding to the probability of occurrence of each character in the IPv6 address encoding dictionary in the inference stage, controls the output probability distribution by a temperature parameter T, and randomly extracts one of the top top_k characters weighted by the probability as the generated character to generate a candidate IPv6 address.

6. The high-efficiency IPv6 address detection method based on a neural network model according to claim 5, characterized in that, In step 2, the plurality of IPv6 seed address data sets are used to train the neural network model, which comprises: using a self-supervised training mode to train the plurality of IPv6 seed address data sets respectively; without manual annotation of the data, the target data is generated by the IPv6 seed address data itself; the model loss function is selected as cross-entropy loss, the optimizer is selected as Adam, the learning rate is adjusted adaptively, and the parameters are updated using the first and second moments of the gradient.

7. The efficient IPv6 address probing method based on a neural network model according to claim 6, characterized in that, In step 2, the trained neural network model is used to generate a candidate IPv6 address, which comprises: Calculating the IPv6 address bit by bit to generate an initial candidate IPv6 address; Removing duplicate addresses from the initial candidate IPv6 address to obtain the final candidate IPv6 address.

8. The efficient IPv6 address probing method based on a neural network model according to claim 7, characterized in that, In step 3, before performing active address detection on the generated candidate IPv6 address, the final candidate IPv6 address is removed from the IPv6 seed address and the alias prefix address.

9. The efficient IPv6 address probing method based on a neural network model according to claim 8, characterized in that, Model width, number of decoder layers in the neural network model described in step 2 N Feedforward network internal dimension of the decoder layer d ff Number of attention heads h Dropout rate, normalization layer temperature parameter, and top_k are all hyperparameters, which are adjusted according to the actual situation of the training data set.

Images