IPv6 address space construction method, updating method, detection method and system
By constructing an IPv6 address space using a two-level classification and strategy generation method, the problem of resource waste caused by poor seed address quality is solved, and efficient IPv6 address space detection and resource allocation are achieved.
Patent Information
- Application Number
- CN202511180373.6
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-08-22
- Publication Date
- 2025-11-07
AI Technical Summary
Existing IPv6 address space construction techniques based on seed addresses are prone to misallocation of probe resources when the seed address quality is poor, resulting in resource waste and low probe efficiency.
A two-level classification method is used to construct the IPv6 address space. First, a classification is performed based on address attribute features, and then a secondary classification is performed based on suffix value quantization features. Target addresses are generated by combining Single, List, Range and Wildcard strategies, and activity and alias verification are performed.
It improves the efficiency of IPv6 address space probing, rationally allocates probing resources, adapts to the dynamically changing IPv6 network environment, reduces resource waste, and improves address space quality.
Smart Images
Figure CN120915696A_ABST
Abstract
Description
TECHNICAL FIELD
[0001] The present application belongs to the technical field of network detection, and more particularly relates to an IPv6 address space construction method, an updating method, a detection method and a system. BACKGROUND
[0002] Network address detection aims to obtain IP addresses of active devices for topology discovery, intrusion detection or launching network attacks, and plays a key role in network security management. With the exhaustion of IPv4 addresses, IPv6 will become the standard of future Internet, and its huge address space makes the brute force scanning technology of IPv4 network no longer feasible. Therefore, it is of great significance to study an IPv6 space detection method.
[0003] IPv6 address space construction is an important part of IPv6 address space detection. Under the existing technical framework, the mainstream scheme is IPv6 detection based on seed addresses. By analyzing the characteristics of known active "seed addresses" for modeling, a high-density IPv6 address space of active addresses is obtained, thereby effectively reducing the detection range and significantly improving the detection efficiency. However, it still has some problems.
[0004] The existing IPv6 address space construction technology based on seed addresses follows a similar construction framework. First, the existing IPv6 seed addresses are divided into different address space nodes using a clustering algorithm. The value of the seed addresses in different dimensions in the space node is counted, and a certain strategy is used to expand the variable dimension addresses of the address space for space modeling. However, this method usually calculates the statistics of the entire seed address set as the basis for space modeling, and is seriously dependent on the entire seed address set. When the quality of the seed address set is poor, the allocation of detection resources is easily misled, which easily causes resource waste and low efficiency of subsequent IPv6 address space detection. SUMMARY
[0005] In view of the above defects or improvement needs of the prior art, the present application provides an IPv6 address space construction method, an updating method, a detection method and a system to solve the technical problems that the allocation of detection resources is easily misled, resource waste is easily caused, and the efficiency of subsequent IPv6 address space detection is low.
[0006] To achieve the above purpose, in a first aspect, the present application provides an IPv6 address space construction method, comprising: The process involves obtaining the address attribute features and suffix value quantization features of each seed address in the historical IPv6 seed address set. Based on the address attribute features, the seed addresses in the IPv6 seed address set are classified once, storing seed addresses with the same primary classification category in the same first-level classification node, and seed addresses with different primary classification categories in different first-level classification nodes, thus constructing an initial classification space. Based on the suffix value quantization features, the seed addresses in each first-level classification node in the initial classification space are further classified a second time, and each first-level classification node is divided according to the following rules to obtain the IPv6 address space. The division rules are as follows: each first-level classification node is divided into a number of second-level classification nodes equal to the number of secondary classification types of the seed addresses within it; under the same first-level classification node, seed addresses with the same secondary classification category are stored in the same second-level classification node, and seed addresses with different secondary classification categories are stored in different second-level classification nodes. The suffix value quantization feature is Q or logQ+1, where Q is the ratio of the maximum frequency of each half-byte in the seed address suffix to the number of possible half-byte values for that seed address suffix.
[0007] More preferably, the above-mentioned address attribute features include: the BGP prefix and / or IID type of the seed address.
[0008] In a second aspect, the present invention provides a method for updating an IPv6 address space, wherein the IPv6 address space is constructed using the IPv6 address space construction method provided in the first aspect of the present invention; The above update method includes: when a new set of IPv6 seed addresses S is obtained, performing the following operations: Obtain the address attribute features and suffix value quantization features of each seed address in S; classify the seed addresses in S based on the address attribute features, dividing the seed addresses in S into multiple subsets; seed addresses with the same classification category are placed in the same subset, and seed addresses with different classification categories are placed in different subsets; and perform operations A1~A5 on each subset. A1. Query the current subset s in the IPv6 address space. When a first-level category node with the same primary category as s is found... s If yes, proceed to A2; otherwise, proceed to A4. A2. Determine the number of seed addresses in the current subset s and the number of nodes. s Check if the ratio of the number of seed addresses exceeds a preset ratio. If it does, proceed to A5; otherwise, proceed to A3. A3. For each seed address a in the current subset s s , for a sAfter the secondary classification based on the suffix value quantification features, a query is performed in the IPv6 address space, and when a secondary classification node with the same secondary classification category as a s is queried, a s is inserted into the secondary classification node; otherwise, a new secondary classification node is created in node s , and a s is inserted into the new secondary classification node. A4, a new primary classification node node n is created in the IPv6 address space, and the current subset s is inserted into node n , and the seed address in node n is classified based on the suffix value quantification features, and node n is divided according to the division rule. A5, the current subset s is inserted into node s , and the seed address in node s is re-classified based on the suffix value quantification features, and node s is divided according to the division rule, so as to update the IPv6 address space. The division rule is the division rule in the IPv6 address space construction method provided in the first aspect of the present application.
[0009] In a third aspect, the present application provides an IPv6 address space detection method, which is used for address detection in the IPv6 address space constructed by the construction method provided in the first aspect of the present application or the IPv6 address space updated by the updating method provided in the second aspect of the present application, and specifically includes: B1, calculating the statistical quantity corresponding to each seed address nibble position in the IPv6 address space, including: range, Shannon entropy and value category number; wherein the range is the difference between the maximum value and the minimum value of the nibble at the corresponding nibble position in the IPv6 address space; the Shannon entropy is: ; wherein is the probability of the value v of all nibbles at the corresponding nibble position; f is a hexadecimal number f ; and the value category number is the value category number of all nibbles at the corresponding nibble position. B2, for each seed address nibble position in the IPv6 address space, when the number of value categories at the nibble position is 1, assign Single strategy to the nibble position; when the range, Shannon entropy and the number of value categories at the nibble position are all greater than the corresponding preset threshold, assign Wildcard strategy to the nibble position; when the values of each address nibble at the nibble position are different and discontinuous, and the number of value categories is less than or equal to the corresponding preset threshold, assign List strategy to the nibble position; when the values of each address nibble at the nibble position are different, and the absolute value of the difference between any two adjacent values after ordering the values of each address nibble at the nibble position is less than a preset value, assign Range strategy to the nibble position; B3, based on the assigned strategies, calculate the target address space range ; wherein, w is the number of nibbles assigned with Wildcard strategy; is a set consisting of the nibble positions in the IPv6 address space assigned with List strategy; is the number of value categories of each address nibble at the nibble position with index i ; is a set consisting of the nibble positions in the IPv6 address space assigned with Range strategy; is the absolute value of the difference between the first and last values after ordering the values of each address nibble at the nibble position with index j plus 1; B4, based on the target address space range SR and the strategies assigned to each seed address nibble position in the IPv6 address space, generate target addresses, and perform liveness verification and alias verification on the target addresses.
[0010] Further preferably, the liveness verification and alias verification are performed by sending ICMPv6 packets to the target addresses.
[0011] Further preferably, the alias verification is implemented by the following method: P1, perform formatting operation on the historical IPv6 alias prefix set: For each IPv6 alias prefix in the historical IPv6 alias prefix set: when the length of the IPv6 alias prefix is not an integer multiple of 4, replace it with a subnet with an integer multiple of 4 in length, and ensure that the address space corresponding to the replaced IPv6 alias prefix completely covers the address space corresponding to the replaced IPv6 alias prefix; perform zero padding operation before the highest bit after expansion of the IPv6 alias prefix to make the length of the obtained string after zero padding 128 bits, thereby converting each IPv6 alias prefix into a string; The obtained strings are classified according to the length of the original IPv6 alias prefix part in the string, and the strings with the same length are classified into one class; P2, using the IPv6 active address detection algorithm, generating a plurality of target prefixes based on the formatted historical IPv6 alias prefix set; P3, using the alias prefix verification algorithm to verify each target prefix to determine whether the target prefix is an alias prefix.
[0012] In a fourth aspect, the present application provides an IPv6 address space detection system, comprising a memory and a processor, the memory stores a computer program, and the processor executes the computer program to execute the IPv6 address space detection method provided in the third aspect of the present application.
[0013] In a fifth aspect, the present application provides an electronic device, comprising a memory and a processor, the memory stores a computer program, and the processor executes the computer program to execute the method provided in the first aspect, the second aspect or the third aspect of the present application.
[0014] In a sixth aspect, the present application further provides a computer readable storage medium, the computer readable storage medium comprises a stored computer program, wherein when the computer program is run by a processor, the storage medium controls the device where the storage medium is located to execute the method provided in the first aspect, the second aspect or the third aspect of the present application.
[0015] In a seventh aspect, the present application further provides a computer program product, comprising computer programs / instructions, which are executed by a processor to implement the method provided in the first aspect, the second aspect or the third aspect of the present application.
[0016] Overall, the above technical solutions conceived by the present application can achieve the following beneficial effects: 1. The present application provides an IPv6 address space construction method, which first classifies a historical IPv6 seed address set based on address attribute characteristics to obtain an initial classification space, and then classifies the initial classification space based on suffix value quantization characteristics to obtain an IPv6 address space. The suffix value quantization characteristics can accurately describe the value of the IPv6 address suffix. The present application classifies the historical IPv6 seed address set in two levels based on the address attribute characteristics and the suffix value quantization characteristics, which can fully utilize the value characteristics of each part of the IPv6 address, realize the subdivision of the IPv6 seed address, and solve the technical problems that the allocation of the existing technology detection resources is easily misled, resource waste is caused, and the subsequent IPv6 address space detection efficiency is low.
[0017] 2. The application provides an IPv6 address space updating method, when a new IPv6 seed address set is acquired, in order to more truly restore a dynamically changing address space, when too many addresses are newly added in a first classification node, the node is reconstructed with a proper granularity, when the ratio of the number of seed addresses in the current subset s to the number of seed addresses in node s exceeds a preset ratio, the seed addresses in the corresponding first classification node are reclassified, so that the split point of the second classification node adapts to the address distribution change, so that the space is balanced, and a premise is provided for subsequent reasonable allocation of exploration resources; meanwhile, the application can persist the characteristics of the inventory addresses, when there are new addresses to be processed, the incremental address characteristics and the inventory address characteristics are combined, and a target address set is generated again, so that subsequent IPv6 address space exploration can make full use of the inventory address characteristics, avoid resource waste, and adapt to a dynamically changing complex IPv6 network environment; based on this, the application can further improve the efficiency of subsequent IPv6 address space exploration.
[0018] 3. The application provides an IPv6 address space exploration method, in view of the dynamic nature of the IPv6 network, four representation strategies, Single, List, Range and Wildcard, are adopted to generate the mode representation of each seed address in the IPv6 address space, the representation strategy of each half-byte position is determined by calculating the range, the Shannon entropy and the number of value types, the segmented balanced space mode representation is used to model the classified address set to generate a target address space range, and then a target address is generated, so that the reasonable allocation of exploration resources is realized, and the exploration efficiency is improved.
[0019] 4. Further, in the existing IPv6 address space exploration method, the detection of the IPv6 alias prefix is limited to passive detection and verification, and the alias prefix is not actively explored and processed, the IPv6 address space exploration method provided by the application formats the IPv6 alias prefix and verifies each target prefix by using an alias prefix verification algorithm, realizes the "active exploration" of the IPv6 alias prefix, can more efficiently include more potential and difficult-to-find alias addresses, greatly reduces the missed report situation, and further improves the quality of the generated address space and further reduces unnecessary resource consumption. BRIEF DESCRIPTION OF DRAWINGS
[0020] Figure 1 The IPv6 address space updating method flowchart provided by the embodiment of the application; Figure 2 The IPv6 address dynamic exploration framework diagram provided by the embodiment of the application; Figure 3A flow chart of an IPv6 address space exploration method provided by an embodiment of the present application is shown in FIG. 1. Figure 4 A diagram of a prefix adaptive IPv6 exploration process provided by an embodiment of the present application is shown in FIG. 2. Figure 5 A principle diagram of IPv6 address space dynamic exploration provided by an embodiment of the present application is shown in FIG. 3. DETAILED DESCRIPTION
[0021] In order to make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and should not be used to limit the present application. In addition, the technical features involved in the various embodiments of the present application described below can be combined with each other as long as they do not conflict with each other.
[0022] In order to achieve the above-mentioned purpose, in a first aspect, the present application provides an IPv6 address space construction method, comprising: obtaining address attribute features and suffix value quantization features of each seed address in a historical IPv6 seed address set; performing a first classification on the seed addresses in the IPv6 seed address set based on the address attribute features, storing the seed addresses with the same first classification category in the same first classification node, and storing the seed addresses with different first classification categories in different first classification nodes, thereby constructing an initial classification space; performing a second classification on the seed addresses in each first classification node in the initial classification space based on the suffix value quantization features, and dividing each first classification node according to a division rule to obtain an IPv6 address space; wherein the division rule is that the first classification node is divided into second classification nodes with the same number as the number of second classification types of the seed addresses in the first classification node; the seed addresses with the same second classification category are stored in the same second classification node, and the seed addresses with different second classification categories are stored in different second classification nodes under the same first classification node; the suffix value quantization features are Q or logQ+1; Q is the ratio of the maximum value of the occurrence frequency of each nibble in the suffix of the corresponding seed address to the number of nibble value types of the suffix of the seed address.
[0023] In an optional embodiment, the address attribute features include the BGP prefix and / or the IID type of the seed address.
[0024] In order to further illustrate the IPv6 address space construction method provided by the present application, a specific embodiment will be described in detail below: In this embodiment, when the user inputs a set of active IPv6 seed addresses, the addressing features of a single address are extracted to perform two-level classification (two times of classification) on the address set. It should be noted that two-stage classification does not mean that the address is classified twice, nor does it mean that the algorithm relies on only two features to classify the address, but rather that the two stages of classification have different characteristics to reasonably support the incremental address processing needs of dynamic detection. In order to be able to directly map the incremental address to the existing space node, all classification indicators need to be addressing features that only rely on a single IPv6 address. In addition, in order to more truly restore the dynamically changing address space, when there are too many addresses in the node, the node can be reconstructed with appropriate granularity, and the determination of the splitting point of the first-stage classification node needs to be independent of the address set, and the splitting point of the second-stage classification node needs to be able to adapt to the changes in the distribution of addresses.
[0025] The first-stage classification indicator is an address attribute feature, which can be the BGP prefix of the seed address, the IID type, etc. The second-stage classification indicator is a suffix value quantization feature, which considers the IID value quantization indicator, which only relies on a single address extraction, and the splitting point can be dynamically adjusted. However, the length of the IID is fixed at 64 bits, and the length of the BGP prefix is not fixed. If only the IID value quantization indicator is used for secondary classification, the value feature of this small section between the BGP prefix and the IID of the IPv6 address will be ignored, causing distortion in space modeling. Therefore, the application proposes a suffix value quantization indicator based on the IID value quantization indicator to fully utilize the value feature of each part of the IPv6 address.
[0026] Let xi represent the value of the IPv6 address in the ith half byte, and xi has a value range of hexadecimal [0, f]; for a BGP prefix with a length of 4*len, the value range of i is [len, 32]; len is the half byte length of the BGP prefix of the IPv6 address; and the symbol r represents the number of suffix value categories. The indicator Q describing the suffix value is the ratio of the maximum value of the frequency of each half byte in the suffix of the seed address to the number of half byte value categories of the suffix of the seed address, which is specifically:
[0027] Wherein,
[0028] In order to make the distribution of the calculated values more uniform and avoid negative numbers, the embodiment takes the logarithm of Q with a base of 16 and adds one, and the final suffix value quantization indicator is logQ+1.
[0029] In this embodiment, when looking for a split point, firstly, all addresses are arranged in descending order according to the suffix value quantization feature, and then the maximum suffix value quantization index interval Interval of adjacent addresses in the same secondary node is calculated according to the range of the suffix value quantization index of the address set. Then, the addresses are traversed in descending order of the suffix value quantization index, and when the suffix value quantization indexes of two adjacent addresses are greater than Interval, it is represented that different secondary space nodes need to be separated at this point.
[0030] In a second aspect, the present application provides an updating method of IPv6 address space (equivalent to further construction of IPv6 address space when a new IPv6 seed address set is obtained), wherein the IPv6 address space is constructed by using the IPv6 address space construction method provided in the first aspect of the present application. As shown in Figure 1 , the updating method comprises the following steps: obtaining the address attribute feature and the suffix value quantization feature of each seed address in S; performing one-time classification on the seed addresses in S based on the address attribute feature, and dividing the seed addresses in S into multiple subsets; wherein the seed addresses with the same one-time classification category are divided into the same subset, and the seed addresses with different one-time classification categories are divided into different subsets; and performing operations A1-A5 on each subset; A1, querying the current subset s in the IPv6 address space, and when a primary classification node node s with the same one-time classification category as s is queried, turning to A2; otherwise, turning to A4; A2, judging whether the ratio of the number of seed addresses in the current subset s to the number of seed addresses in node s exceeds a preset ratio, and if yes, turning to A5; otherwise, turning to A3; in an optional implementation, the preset ratio is 30%-50%, and preferably 40%.
[0031] A3, for each seed address a s in the current subset s, performing secondary classification on a s based on the suffix value quantization feature thereof, and querying in the IPv6 address space, and when a secondary classification node with the same secondary classification category as a s is queried, inserting a s into the secondary classification node; otherwise, creating a new secondary classification node in node s , and inserting a s into the new secondary classification node; A4, creating a new primary classification node node ninserting the current subset s into the node n , and performing secondary classification on the seed address in the node n based on the suffix value quantification feature, and dividing the node n according to the division rule; A5、inserting the current subset s into the node s , and performing secondary classification on the seed address in the node s based on the suffix value quantification feature, and dividing the node s according to the division rule, to update the IPv6 address space. The division rule is the division rule in the IPv6 address space construction method provided in the first aspect of the present application.
[0032] The related technical solution is the same as the method provided in the first aspect of the present application, which will not be repeated here.
[0033] In the third aspect, the present application provides an IPv6 address space detection method, which is used for address detection in the IPv6 address space constructed by the construction method provided in the first aspect of the present application or the IPv6 address space updated by the updating method provided in the second aspect of the present application, as shown in Figure 2 , specifically comprising: B1、calculating the statistical quantity corresponding to each seed address nibble position in the IPv6 address space, including: range, Shannon entropy and value category number; wherein the range is the difference between the maximum value and the minimum value of the nibble at the corresponding nibble position in the IPv6 address space; the Shannon entropy is: ; wherein is the probability of all nibbles at the corresponding nibble position being v ; the value category number is the value category number of all nibbles at the corresponding nibble position. f f ; the value category number is the value category number of all nibbles at the corresponding nibble position. B2, for each seed address nibble position in the IPv6 address space, when the number of value categories at the nibble position is 1, assign Single strategy to the nibble position; when the range, Shannon entropy and the number of value categories at the nibble position are all greater than the corresponding preset threshold, assign Wildcard strategy to the nibble position; when the values of each address nibble at the nibble position are different and discontinuous, and the number of value categories is less than or equal to the corresponding preset threshold, assign List strategy to the nibble position; when the values of each address nibble at the nibble position are different, and the absolute value of the difference between any two adjacent values after ordering the values of each address nibble at the nibble position is less than a preset value, assign Range strategy to the nibble position; in an optional implementation, the preset threshold corresponding to the range is 4-6, preferably 5; the preset threshold corresponding to the Shannon entropy is 0.5-0.6, preferably 0.55; the preset threshold corresponding to the number of value categories is 10-12, preferably 11. ; wherein, w is the number of nibbles assigned with Wildcard strategy; is a set of nibble positions in the IPv6 address space assigned with List strategy; is the number of value categories of each address nibble at the nibble position with index i ; is a set of nibble positions in the IPv6 address space assigned with Range strategy; is the absolute value of the difference between the first and last values after ordering the values of each address nibble at the nibble position with index j plus 1; B4, based on the target address space range SR and the strategy assigned to each seed address nibble position in the IPv6 address space, generate target addresses, and perform activity verification and alias verification on the target addresses.
[0034] It should be noted that methods such as pattern-based target address generation and wildcard-based target address generation can be used to generate target addresses based on the target address space range SR and the strategy selected for each seed address nibble position in the IPv6 address space.
[0035] The related technical solutions are the same as the methods provided by the first aspect or the second aspect of the present application, and will not be repeated here.
[0036] It should be noted that the space modeling is to find and appropriately expand the variable dimension of the address space to generate the target address. A balanced space pattern representation (BSPR) is proposed in Multi-BSPR-Gen. By analyzing the value distribution of each hexadecimal bit of the input IPv6 address set, a suitable pattern representation is generated. BSPR greatly alleviates the problem of modeling space size, but it ignores the different modeling needs of different parts of the IPv6 address semantics. Compared with the IID part, the hexadecimal bit of the network prefix part changes more simply, and a more conservative modeling strategy should be adopted to avoid the modeling space being too large. Therefore, the present application makes some improvements on the basis of BSPR and proposes a segmented balanced space pattern representation (Segmented BSPR, S-BSPR). S-BSPR mainly consists of two steps, namely multi-strategy pattern generation and segmented strategy selection.
[0037] (1) Multi-strategy pattern generation The present application generates the pattern representation of the IPv6 address set by using four representation strategies of Single, List, Range and Wildcard. The specific meanings and value ranges of the four representation strategies are as follows: 1) Single: fixed value, half-byte value has no change.
[0038] 2) List: change value, the value is limited to all different values actually appearing at this position in the address set.
[0039] 3) Range: change value, the value range is a closed interval, and some intermediate values may not appear in the original set.
[0040] 4) Wildcard: change value, the value range is all hexadecimal values, and some intermediate values may not appear in the original set.
[0041] The pattern representation of the IPv6 address set is generated by using four representation strategies of Single, List, Range and Wildcard. The representation strategy of each hexadecimal bit is determined by calculating the entropy value, the number of value categories and the range of each bit, and the threshold is calculated in the prefix and suffix equal to one different part respectively, and different decisions are adopted.
[0042] In order to determine the most suitable representation for each hexadecimal bit, the present application calculates three statistical quantities: range, Shannon entropy and number of different values. The Shannon entropy of each half-byte position is shown in the following formula according to the definition:
[0043] Wherein, The probability of the value of all nibbles at the corresponding nibble position being v f is a hexadecimal number f ; the value type number is the value type number of all nibbles at the corresponding nibble position. The Shannon entropy takes the value type number of the nibble as the base number, and guarantees that the result is between 0 and 1.
[0044] The present application determines the final representation strategy according to the comparison result of the range, the entropy value and the value type number of each hexadecimal bit of the address set with the preset threshold (range_t, entropy_t, type_t). Table 1 shows an example of an IPv6 address suffix and the specific values of related variables, and details the decision-making process.
[0045] Table 1 Relationship between single dimension representation strategy and range, entropy value and value type number
[0046] (2) Segment strategy selection Calculate the target address space range ; wherein, w is the number of nibbles allocated with the Wildcard strategy; is a set composed of nibble positions allocated with the List strategy in the IPv6 address space; is the value type number of each address nibble at the nibble position with the index i ; is a set composed of nibble positions allocated with the Range strategy in the IPv6 address space; is the absolute value of the difference between the first and last values after sorting the value sequence of each address nibble at the nibble position with the index j plus 1; Like the BSPR, the S-BSPR provided by the present application also needs to solve the problem of determining the range threshold range_t, the entropy value threshold entropy_t and the value type number threshold type_t. The three thresholds are the key to address space modeling, and directly affect the size of the modeling space. If the threshold is set too small, the modeling strategy will gradually degenerate into the same Wildcard strategy as 6Tree and DET, the modeling space will expand rapidly, and the algorithm hit rate will be reduced. If the threshold is set too large, the modeling strategy will gradually degenerate into the List strategy, the modeling space will be excessively contracted, and the generated target address will be severely restricted by the seed address, exacerbating the sample bias problem.
[0047] In an optional embodiment, the ICMPv6 packet is sent to the target address to perform activity verification and alias verification.
[0048] In another alternative embodiment, the alias verification is achieved by the following method: P1, performing a formatting operation on the historical IPv6 alias prefix set: It should be noted that the seed prefix formatting is used to adapt to the 32-bit hexadecimal requirement of IPv6 address detection, and needs to meet the one-to-one mapping of the string before and after formatting. For each IPv6 alias prefix in the historical IPv6 alias prefix set, the following processing is performed: 1) Processing of prefixes whose length is not an integer multiple of 4: Since the IPv6 alias prefix whose length is not an integer multiple of 4 cannot be parsed by the string length to obtain the prefix length, when the length of the IPv6 alias prefix is not an integer multiple of 4, it is replaced by a subnet whose length is an integer multiple of 4, and it is ensured that the address space corresponding to the replaced IPv6 alias prefix can completely cover the address space corresponding to the replaced IPv6 alias prefix; preferably, the prefix whose length is not an integer multiple of 4 is replaced by a number of maximum subnets whose length is an integer multiple of 4.
[0049] 2) One-to-one mapping of strings before and after formatting: the simplest and most intuitive solution is to fill 0 in the low bit non-subnet part, but using such a solution cannot determine whether the 0 after the string is meaningless 0 used for padding or 0 originally owned by the prefix. Therefore, the real meaning and position of the network prefix are temporarily abstracted, and the scheme of filling 0 in the high bit after prefix expansion is adopted. The unique target prefix can be restored by directly removing the 0 after the prefix. Specifically, after expanding the IPv6 alias prefix, a zero filling operation is performed before the highest bit to make the length of the obtained string after zero filling 128 bits, so as to convert each IPv6 alias prefix into a string; 3) Network prefix classification scheme: different length prefixes may interfere with each other and confuse different parts of the prefix semantics. Therefore, before further processing, the network prefix needs to be classified according to the length of the original IPv6 alias prefix part in the string. Specifically, the obtained strings are classified according to the length of the original IPv6 alias prefix part in the string, and those with the same length are classified into one category; P2, generating a plurality of target prefixes based on the formatted historical IPv6 alias prefix set using an IPv6 active address detection algorithm; It should be noted that the IPv6 active address detection algorithm can be any existing IPv6 active address detection algorithm, such as DET, 6Tree, etc., which is not limited here.
[0050] P3, verifying each target prefix using an alias prefix verification algorithm to determine whether the target prefix is an alias prefix.
[0051] It should be noted that the previous prefix verification algorithm can be any existing previous prefix verification algorithm, which is not limited here. In an optional embodiment, an IPv6 address is randomly generated under each subnet of the target prefix, an ICMPv6 packet is sent to the generated random IPv6 address, and the number of response packets is counted to determine whether the target prefix is a previous prefix. This scheme is based on an empirical theory: the IPv6 address space is very sparse, and the probability of all 16 addresses under a certain subnet being active is extremely small and can be ignored.
[0052] As shown in Figure 3 is a flow chart of an IPv6 address space detection method in a specific embodiment.
[0053] As shown in Figure 4 is a card in the prefix adaptive IPv6 detection process schematic diagram in a specific embodiment.
[0054] As shown in Figure 5 is a dynamic IPv6 address space detection principle diagram in a specific embodiment.
[0055] In summary, for IPv6 active address detection, in view of the dynamic nature of the IPv6 network, the two-level classification scheme is designed by using the addressing characteristics of a single address, the addressing characteristics of a single address are extracted to classify the IPv6 seed address set, the segmented balanced space mode is used to model the classified address set and generate the target address, and the characteristics of the stock address are persisted. When there is a new address to be processed, the incremental address characteristics are combined with the stock address characteristics by the feature fusion algorithm, and then the target address set is generated, thereby improving the detection efficiency.
[0056] For the previous prefix problem in IPv6 address allocation, the network prefix is formatted and replaced with a previous prefix verification algorithm to replace the active address verification algorithm, so that most of the current IPv6 address detection algorithms based on seed addresses can be applied to the detection of previous prefixes, and the "active detection" of IPv6 previous prefixes is realized.
[0057] In a fourth aspect, the present application provides an IPv6 address space detection system, comprising: a memory and a processor, the memory storing a computer program, and the processor executing the computer program to execute the IPv6 address space detection method provided in the third aspect of the present application.
[0058] The related technical solution is the same as the IPv6 address space detection method provided in the third aspect of the present application, which is not limited here.
[0059] In a fifth aspect, the present application provides an electronic device, comprising: a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the method provided in the first aspect, the second aspect or the third aspect of the present application.
[0060] The related technical solutions are the same as the method provided in the first aspect, the second aspect or the third aspect of the present application, and are not limited herein.
[0061] In a sixth aspect, the present application further provides a computer readable storage medium, comprising a stored computer program, wherein the computer program, when executed by a processor, controls a device where the storage medium is located to perform the method provided in the first aspect, the second aspect or the third aspect of the present application.
[0062] The related technical solutions are the same as the method provided in the first aspect, the second aspect or the third aspect of the present application, and are not limited herein.
[0063] In a seventh aspect, the present application further provides a computer program product, comprising computer program / instructions, which, when executed by a processor, implement the method provided in the first aspect, the second aspect or the third aspect of the present application.
[0064] The related technical solutions are the same as the method provided in the first aspect, the second aspect or the third aspect of the present application, and are not limited herein.
[0065] Those skilled in the art can easily understand that the above description is only the preferred embodiment of the present application, and is not intended to limit the present application, and any modification, equivalent replacement and improvement made within the spirit and principle of the present application shall be included in the protection scope of the present application.
Claims
1. A method of IPv6 address space construction, characterized by, The application comprises the following steps: obtaining address attribute features and suffix value quantization features of each seed address in a historical IPv6 seed address set; performing primary classification on the seed addresses in the IPv6 seed address set based on the address attribute features, storing the seed addresses with the same primary classification category in the same primary classification node, storing the seed addresses with different primary classification categories in different primary classification nodes, and thus constructing an initial classification space; performing secondary classification on the seed addresses in each primary classification node in the initial classification space based on the suffix value quantization features, and dividing each primary classification node according to a division rule to obtain an IPv6 address space; the division rule is that the primary classification node is divided into secondary classification nodes with the same number as the number of secondary classification types of the seed addresses in the primary classification node; in the same primary classification node, storing the seed addresses with the same secondary classification category in the same secondary classification node, and storing the seed addresses with different secondary classification categories in different secondary classification nodes; the suffix value quantization features are Q or logQ+1; Q is the ratio of the maximum value of the frequency of each nibble in the suffix of the corresponding seed address to the number of nibble value types of the suffix of the seed address.
2. The IPv6 address space construction method of claim 1, wherein, The address attribute features comprise a BGP prefix and / or an IID type of the seed address.
3. A method of updating IPv6 address space, characterized by, The IPv6 address space is constructed by the IPv6 address space construction method in claim 1 or 2. The updating method comprises the following steps when a new IPv6 seed address set S is obtained: obtaining address attribute features and suffix value quantization features of each seed address in S; performing primary classification on the seed addresses in S based on the address attribute features, and dividing the seed addresses in S into multiple subsets; wherein the seed addresses with the same primary classification category are divided into the same subset, and the seed addresses with different primary classification categories are divided into different subsets; and performing operations A1-A5 on each subset. A1. Query the current subset s in the IPv6 address space. When a first-level classification node with the same primary classification category as s is found... s If yes, proceed to A2; otherwise, proceed to A4. A2, determine whether the ratio of the number of seed addresses in the current subset s and the number of seed addresses in node s exceeds a preset ratio, if yes, go to A5; otherwise, go to A3. A3、For each seed address a in the current subset s s , a s is classified again based on the suffix value quantification feature, and a query is performed in the IPv6 address space. When a secondary classification node with the same secondary classification category as a s is found, a s is inserted into the secondary classification node; otherwise, a new secondary classification node is created in node s , and a s is inserted into the new secondary classification node. A4. creating a new first-level classification node node in the IPv6 address space n , and inserting the current subset s into node n , and performing secondary classification on the seed address in node n based on the suffix value quantification feature, and dividing node n according to the division rule; A5, insert the current subset s into node s , and re-classify the seed address in node s based on the suffix value quantity, and divide node s according to the division rule to update the IPv6 address space; The division rule is the division rule in the IPv6 address space construction method in claim 1 or 2.
4. A method of IPv6 address space exploration, characterized in that, The application is used for address detection in the IPv6 address space constructed by the construction method in claim 1 or 2 or the IPv6 address space updated by the updating method in claim 3, and specifically comprises the following steps: B1、calculating the statistical quantity corresponding to each seed address nibble position in the IPv6 address space, including: range, Shannon entropy and value category number; the range is the difference between the maximum value and the minimum value of the nibble at the corresponding nibble position in the IPv6 address space; the Shannon entropy is: ; wherein, is the probability of the value v at the corresponding nibble position; f is a hexadecimal number f ; and the value category number is the value category number of all nibbles at the corresponding nibble position. B2, for each nibble position of each seed address in the IPv6 address space, when the number of value types at the nibble position is 1, a Single strategy is allocated to the nibble position; when the range, the Shannon entropy and the number of value types at the nibble position are all greater than the corresponding preset threshold, a Wildcard strategy is allocated to the nibble position; when the values of each address nibble at the nibble position are different and discontinuous, and the number of value types is less than or equal to the corresponding preset threshold, a List strategy is allocated to the nibble position; when the values of each address nibble at the nibble position are different, and the absolute value of the difference between any two adjacent values after the values of each address nibble at the nibble position are sorted in order is less than a preset value, a Range strategy is allocated to the nibble position. B3. Calculate the target address space range based on the assigned policy ; wherein, w is the number of nibbles assigned with Wildcard policy; is the set of nibble positions in the IPv6 address space assigned with List policy; is the number of value categories of each address nibble at the nibble position indexed by i ; and is the set of nibble positions in the IPv6 address space assigned with Range policy; is the absolute value of the difference between the first and the last value in the ordered list of values of each address nibble at the nibble position indexed by j plus 1. B4. generating a target address based on the target address space range SR and the policy of allocating each seed address nibble position in the IPv6 address space, generating a target address, and performing liveness verification and alias verification on the target address.
5. The IPv6 address space exploration method of claim 4, wherein, sending an ICMPv6 packet to the target address to perform the reachability verification and the alias verification.
6. The IPv6 address space exploration method of claim 4, wherein, The alias verification is implemented by the following method: P1, performing a formatting operation on a historical IPv6 alias prefix set: For each IPv6 alias prefix in the historical IPv6 alias prefix set: when the length of the IPv6 alias prefix is not an integer multiple of 4, replace it with a subnet with an integer multiple of 4 in length, and ensure that the address space corresponding to the replaced IPv6 alias prefix completely covers the address space corresponding to the replaced IPv6 alias prefix; Perform a zero padding operation before the highest bit of the expanded IPv6 alias prefix to make the length of the obtained string 128 bits, thereby converting each IPv6 alias prefix into a string; Classify the obtained strings according to the length of the original IPv6 alias prefix part in the string, and classify the strings with the same length into one class; P2, using an IPv6 active address detection algorithm to generate a plurality of target prefixes based on the formatted historical IPv6 alias prefix set; P3, using an alias prefix verification algorithm to verify each target prefix to determine whether the target prefix is an alias prefix.
7. An IPv6 address space exploration system, characterized by It comprises: a memory and a processor, the memory stores a computer program, and the processor executes the computer program to execute the IPv6 address space detection method of any one of claims 4-6.
8. An electronic device, comprising: It comprises: a memory and a processor, the memory stores a computer program, and the processor executes the computer program to execute the method of any one of claims 1-6.
9. A computer-readable storage medium, characterized in that, The computer readable storage medium comprises a stored computer program, wherein when the computer program is run by a processor, it controls the device where the storage medium is located to perform the method of any one of claims 1-6.
10. A computer program product, characterised in that, It comprises a computer program / instruction, which is executed by a processor to implement the method of any one of claims 1-6.