IPv6 lightweight network device mapping method based on behavior fingerprint and hop count verification

Abstract

The present application relates to IPv6 lightweight network device mapping method based on behavior fingerprint and hop verification;Including the following steps: collecting the metadata of original traffic in IPv6 network;Selecting multi-dimensional feature vector from metadata and processing, generating unique and stable fingerprint identification for each device;Sending probe packet to target device, calculating forward path hop count, estimating return path hop count for response packet return path hop count, detecting path by comparing forward path hop count and return path hop count;Fingerprint identification is used as topology node, and bidirectional path hop detection value is used as the topology edge weight between devices, the initial topology skeleton is constructed by minimum spanning tree algorithm, and the network topology structure is obtained by clustering optimization combined with auxiliary data;According to fingerprint identification, node hop count, connection density and behavior consistency, the hierarchical relationship is automatically inferred, and the interactive logical topology graph is generated, which is used for displaying abnormal nodes and associated path.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network and information security, and in particular to an IPv6 lightweight network device mapping method based on behavior fingerprints and hop count verification. BACKGROUND

[0002] With the accelerated deployment of IPv6 protocol and its wide application in government and enterprise networks and operator networks, the global Internet is moving towards a new connection system dominated by IPv6. IPv6 provides almost unlimited address space, supporting the allocation of unique globally routable addresses for each terminal device, which greatly promotes the network access capability of new businesses such as the Internet of Things and edge computing. However, the new mechanisms introduced by IPv6 also pose a serious challenge to traditional network management, security monitoring and topology awareness methods.

[0003] Firstly, the number of IPv6 addresses is huge, and the traditional mapping method relying on address segment traversal and port scanning is almost ineffective in the IPv6 environment, with much lower efficiency than in the IPv4 era, large resource consumption and low coverage. Secondly, IPv6 generally enables privacy extension mechanisms (such as temporary addresses defined in RFC4941), and the IP address of a terminal device will change periodically, making it difficult to associate device identification and historical behavior based on IP addresses, and causing devices to frequently "disappear" or be "misjudged" as new devices in the topology graph. Thirdly, in terms of network security, hackers or malicious nodes can use the hop limit field in the IPv6 header to perform path forgery or identity spoofing, causing topology judgment errors or defense bypasses. In addition, due to the deeper and more complex structure of IPv6 networks compared to IPv4, the connection relationship between devices is more hidden, and current mainstream topology mapping methods often only provide limited path information, lacking the ability to restore the global structure of the network, making it difficult to meet the needs of regulatory, security situation awareness, resource management and other scenarios.

[0004] Therefore, there is an urgent need for a new topology mapping technology that adapts to the characteristics of IPv6 networks, does not require high-intensity scanning, can identify dynamic devices and has the ability to verify the authenticity of paths, to solve the multiple deficiencies of existing methods in terms of efficiency, accuracy and security.

[0005] To this end, the present application provides an IPv6 lightweight network device mapping method based on behavior fingerprints and hop count verification. SUMMARY

[0006] The present application provides an IPv6 lightweight network device mapping method based on behavior fingerprints and hop count verification to solve the technical problems in the prior art.

[0007] The technical scheme for solving the above technical problems is as follows: an IPv6 lightweight network device mapping method based on behavior fingerprint and hop count verification, comprising the following steps:

[0008] S1: device monitoring and data collection: collecting metadata of original traffic in an IPv6 network;

[0009] S2: behavior fingerprint generation: selecting a multi-dimensional feature vector from the metadata and processing it to generate a unique and stable fingerprint identifier for each device;

[0010] S3: bidirectional path hop count detection: the bidirectional path hop count includes forward path hop count and reverse path hop count, a probe packet is sent to a target device, the forward path hop count is calculated, the reverse path hop count is estimated based on the return path hop count of the response packet, and the path is detected by comparing the forward path hop count and the reverse path hop count;

[0011] S4: network topology construction: taking the fingerprint identifier as a topology node and the bidirectional path hop count detection value as the topology edge weight between devices, an initial topology skeleton is constructed by a minimum spanning tree algorithm, and the network topology structure is obtained by clustering optimization combined with auxiliary data;

[0012] S5: visualization: automatically inferring hierarchical relationships based on fingerprint identifiers, node hop counts, connection tightness and behavior consistency, generating an interactive logical topology graph for displaying abnormal nodes and associated paths.

[0013] Further, the IPv6 lightweight network device mapping method based on behavior fingerprint and hop count verification, the behavior fingerprint generation step comprises:

[0014] The multi-dimensional feature vector is processed by a local weighted hashing algorithm to generate a device behavior fingerprint; first, the input multi-dimensional feature vector is assigned a weight vector according to the dimension to generate a weighted vector , wherein n represents the nth multi-dimensional feature vector;

[0015] Then, the local sensitive hashing function is used to map it to a fixed-length binary fingerprint, and the function is designed to satisfy: when the weighted Euclidean distance of device behavior characteristics , , wherein is a network normal fluctuation threshold, and are the weighted vectors of device and device , respectively, P is the hash function and device after the hash function Probability of the same result after mapping.

[0016] Further, the IPv6 lightweight network device mapping method based on behavior fingerprint and hop verification, the forward path hop count calculation comprises:

[0017] Forward path hop count calculation: sending a probe packet to the target device, calculating the hop count of the forward path by recording the number of routers passed by the probe packet;

[0018] The calculation formula is: H_forward=Initial Hop Limit-Hop_Limit;

[0019] Where H_forward is the forward path hop count, Initial Hop Limit is the initial hop limit, and Hop_Limit is the response packet.

[0020] Further, the IPv6 lightweight network device mapping method based on behavior fingerprint and hop verification, the estimation of the return path hop count of the response packet to obtain the reverse path hop count comprises:

[0021] For the response packet returned by the target device, the historical path measurement feature library accumulated locally is used for estimation, including:

[0022] Building a historical database: recording the bidirectional path hop count measurement results of the same device in the past;

[0023] Feature extraction: forward path hop count, reverse path hop count, RTT, AS path length and probe time, hop count asymmetry ratio, RTT / hop count ratio and shared link flag;

[0024] Real-time matching: according to the forward path hop count of the current device, querying the distribution of the corresponding reverse path hop count in the historical database;

[0025] Dynamic compensation of compensation model: real-time consideration of network asymmetry and shared link to compensate the estimated value of the return path hop count.

[0026] Further, the IPv6 lightweight network device mapping method based on behavior fingerprint and hop verification, the dynamic compensation of the compensation model comprises:

[0027] Real-time input: features of the current device;

[0028] Model output: predicted reverse path hop count+confidence interval;

[0029] If the variance of the reverse path hop count corresponding to the forward path hop count in the historical database is small, the predicted value is directly used;

[0030] If the current RTT deviates from the predicted value significantly, re-probing is triggered.

[0031] Further, the IPv6 lightweight network device mapping method based on behavior fingerprint and hop verification comprises the steps of:

[0032] The fingerprint identification of the device is defined as a topology node, and the hop difference between the devices is defined as an edge weight value.

[0033] The minimum spanning tree algorithm is used to preferentially select the path with the minimum hop difference, and a sparse initial topology skeleton is constructed.

[0034] Based on the initial topology skeleton, the devices are grouped according to the prefix of the IPv6 address, and the devices with the same prefix are preferentially allocated to the same sub-tree to form a logical sub-tree, so that the sparse initial skeleton is optimized into a hierarchical logical topology structure.

[0035] The logical sub-tree is used to represent different management domains or subnets in the final visual topology graph, and serves as a basis for judging the abnormal communication behavior of the device.

[0036] Further, the IPv6 lightweight network device mapping method based on behavior fingerprint and hop verification comprises the steps of:

[0037] IPv6 address attribution information: prefix segment, ASN number and address cluster distribution allocated by the operator, and preliminary division of the network belonging range;

[0038] Geographical location information: the physical location of the device is inferred through an IP geographical positioning database, delay measurement or link characteristics;

[0039] Path hop difference value matrix: the relative hops between target devices are obtained by the forward and reverse probing mechanism, and are used to estimate the topology distance relationship.

[0040] The beneficial effects of the present application are:

[0041] The reverse path hop number is inferred to supplement the forward path hop number measurement, the dynamic verification of the bidirectional path hop number is realized, the accuracy and robustness of the hop number measurement are significantly improved, the path asymmetry problem that cannot be covered by the traditional unidirectional probing is effectively solved, and the misjudgment risk caused by the path difference is reduced; through the accurate bidirectional path hop number verification, the integrity and credibility of the network topology inference are enhanced, key technical support is provided for the network mapping in the complex IPv6 environment, and the effect of network management and security monitoring is significantly optimized.

[0042] By collecting the stable behavior characteristics of terminal equipment in the network, such as DNS request, service access time period, target domain name, etc., the network behavior fingerprint of the equipment is constructed, the identity of the equipment is continuously identified, even in the scene of frequent change of IPv6 temporary address, the device behavior track can be accurately tracked, and the positive and reverse hop count verification mechanism is introduced, the Hop Limit value in the path is compared through bidirectional detection, whether there is path forgery or man-in-the-middle attack is detected, so as to improve the credibility of the path information; Comprehensive device behavior data, hop distance information and address attribution information, the system can automatically infer the connection relationship between the devices, and finally generate a visual IPv6 network topology map, which comprehensively shows the network structure level. BRIEF DESCRIPTION OF DRAWINGS

[0043] Figure 1 is a flowchart of an IPv6 lightweight network equipment mapping method based on behavior fingerprint and hop count verification.

[0044] Figure 2 is a schematic diagram of an embodiment;

[0045] Figure 3 is a schematic diagram of bidirectional path hop count detection in an embodiment. DETAILED DESCRIPTION

[0046] The technical solutions in the embodiments of the present application will be described clearly and completely in the present application with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0047] In the description of the present application, the terms "first", "second" are used only for the purpose of description, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include one or more of the features. In the description of the present application, the meaning of "multiple" is two or more, unless otherwise specifically limited.

[0048] In the description of the present application, the term "for example" is used to indicate "serving as an example, instance, or illustration." Any embodiment described as "for example" in this application is not necessarily to be construed as preferred or advantageous over other embodiments. The following description is presented to enable any person skilled in the art to make and use the application. In the following description, for the purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the present application. It will be apparent, however, to one skilled in the art that the present application can be practiced without using these specific details. In other instances, well-known structures and processes are not elaborated upon in order to avoid unnecessary detail, which can obscure the description of the present application. Thus, the present application is not intended to be limited to the embodiments shown, but is to be accorded the widest scope consistent with the principles and features disclosed herein.

[0049] As Figure 1 and Figure 2 shown, in one embodiment, the IPv6 lightweight network device mapping method based on behavior fingerprint and hop verification; comprising the following steps:

[0050] S1: device monitoring and data collection: collecting metadata of original traffic in IPv6 network;

[0051] S2: behavior fingerprint generation: selecting multi-dimensional feature vector from metadata and processing, generating unique and stable fingerprint identification for each device;

[0052] S3: bidirectional path hop detection: the bidirectional path hop includes forward path hop and reverse path hop, sending a probe packet to the target device, calculating the forward path hop, estimating the reverse path hop for the return path hop of the response packet, and detecting the path by comparing the forward path hop and the reverse path hop;

[0053] S4: network topology construction: taking the fingerprint identification as the topology node, and taking the bidirectional path hop detection value as the topology edge weight between devices, constructing the initial topology skeleton through the minimum spanning tree algorithm, and combining auxiliary data for clustering optimization to obtain the network topology structure;

[0054] S5: visualization: automatically inferring hierarchical relationship according to fingerprint identification, node hop, connection tightness and behavior consistency, generating an interactive logical topology graph for displaying abnormal nodes and associated paths.

[0055] In this embodiment, the original traffic in the IPv6 network is monitored by a network monitoring tool (such as a network sniffer) at a network key node (such as a router, a switch port), and the metadata of the traffic is collected. The metadata usually includes source IP address, destination IP address, port number, protocol type, packet size, timestamp, etc. From the collected metadata, the attributes that can reflect the behavior characteristics of the device are selected as dynamic weight features. For example, the communication frequency of the device, the protocol combination used, the traffic distribution in different time periods, etc. The weights of these features are not fixed and will be dynamically adjusted according to the real-time behavior of the device. The selected dynamic weight features are combined together using a specific algorithm (such as a hash algorithm) to generate a unique fingerprint identifier for each device. This fingerprint identifier is like the "identity card" of the device, which can accurately identify the device in the subsequent network mapping process.

[0056] Specifically, the behavior fingerprint generation step includes:

[0057] The local weighted hash algorithm is used to reduce the dimension of the multi-dimensional feature vector to generate the device behavior fingerprint. First, the input multi-dimensional feature vector is assigned a weight vector according to the dimension , and a weighted vector is generated, where n represents the nth multi-dimensional feature vector.

[0058] Then, the local sensitive hash function is used to map it to a fixed-length binary fingerprint, and the function is designed to satisfy: when the weighted Euclidean distance of device behavior features , , where is the network normal fluctuation threshold, and are the weighted vectors of device and device , respectively, and P is the probability that the results of device and device after mapping by the hash function are the same.

[0059] In this embodiment, the device behavior fingerprint is represented by a multi-dimensional feature vector, including but not limited to:

[0060] Basic five-tuple: source / destination IPv6 address, port number, protocol type (TCP / UDP / ICMPv6);

[0061] Time characteristics: average communication interval, burst traffic entropy value (measuring communication randomness);

[0062] Interaction mode: protocol combination matrix (such as the joint probability of HTTP+DNS);

[0063] Device state: active duration, periodic behavior (e.g., IoT device's scheduled reporting).

[0064] According to the feature vector Assign a weight vector by dimension , generate a weighted vector , compress the multi-dimensional features into a scalar, retain the key information while reducing the computational complexity, and the weighted sum can be considered as a "comprehensive score" of the feature, reflecting the overall state of the device behavior; then map it to a fixed-length binary fingerprint through a local sensitive hash function The hash function is to map the scalar value to a binary bit (0 or 1) through a random threshold, and the hash values of similar devices are similar, the collision probability is high in multiple hashing, and the devices with large differences are different in bucketing due to random threshold, and the fingerprints are significantly different.

[0065] Specifically, the forward path hop count calculation includes:

[0066] Forward path hop count calculation: send a probe packet to the target device, and calculate the hop count of the forward path by recording the number of routers the probe packet passes through; this can be achieved by setting the hop limit of the probe packet and observing the response of the router.

[0067] The calculation formula is: H_forward=Initial Hop Limit-Hop_Limit;

[0068] Where H_forward is the forward path hop count, Initial Hop Limit is the initial hop limit, and Hop_Limit is the response packet.

[0069] In this embodiment, the probe packet is sent: use tools such as trace route (based on ICMP / UDP / TCP protocol) or mtr to send a probe packet to the target device;

[0070] The TTL (Time-To-Live) field of the probe packet starts from 1 and increases by 1 (e.g. 1, 2, 3,...).

[0071] TTL=1: the first hop router receives it and reduces it to 0, discards the packet and returns an ICMP Time Exceeded response.

[0072] TTL=2: the second hop router returns a response, and so on.

[0073] Record the hop count:

[0074] By analyzing the response (IP address or timeout information) of each hop router, the number of hops required to reach the target device is counted.

[0075] Termination condition: when the TTL of the probe packet is large enough, the target device returns an ICMP Echo Reply (such as a ping response), at which time the hop count is the total hop count of the forward path.

[0076] Specifically, the reverse path hop count is estimated based on the response packet return path hop count, including:

[0077] For the response packet returned by the target device, the historical path measurement feature library accumulated locally is used for estimation, and the historical path measurement feature library includes:

[0078] Building a historical database: recording the past bidirectional path hop count measurement results of the same device;

[0079] Feature extraction: forward path hop count, reverse path hop count, RTT, AS path length and probe time, hop count asymmetry ratio, RTT / hop count ratio and shared link flag;

[0080] Real-time matching: according to the current device forward path hop count, the corresponding reverse path hop count distribution in the historical database is queried;

[0081] Dynamic compensation of the compensation model: real-time consideration of network asymmetry and shared links to compensate the estimated value of the return path hop count.

[0082] Specifically, the dynamic compensation method of the compensation model includes:

[0083] Real-time input: current device features;

[0084] Model output: predicted reverse path hop count + confidence interval;

[0085] If the variance of the reverse path hop count corresponding to the forward path hop count in the historical database is small, the predicted value is directly used;

[0086] If the current RTT deviates significantly from the predicted value, re-probing is triggered.

[0087] In this embodiment, the reverse path (target device→source device) is usually asymmetric and cannot be directly probed (requires the cooperation of the target device);

[0088] 1. Based on the symmetry assumption;

[0089] Assumption: the reverse path hop count is the same as or similar to the forward path hop count.

[0090] Applicable scenarios:

[0091] Core network topology is symmetric (such as ISP backbone network).

[0092] Historical data shows that the bidirectional hop count difference is small.

[0093] 2. History feature database matching;

[0094] History database construction:

[0095] Record past hop count measurements (active cooperation required) to the same target.

[0096] Extract features (such as RTT, hop ratio, AS path).

[0097] Real-time matching:

[0098] Current forward hop count is H_forward, query the history of H_forward corresponding reverse hop count H_r distribution (such as median).

[0099] Specifically, compensation model construction: in order to improve the accuracy of return path hop count estimation, based on the local accumulated history path measurement feature database, the compensation model is constructed. This model can consider the asymmetry of network, shared link and other factors, compensate the estimated value of return path hop count, so as to obtain more accurate bidirectional path hop count estimation value.

[0100] In this embodiment, history path measurement database construction:

[0101] Active probe data: periodically perform bidirectional trace route (source→target + target→source, need cooperation of nodes).

[0102] Passive traffic data: analyze existing traffic (such as RTT, TTL change of TCP session).

[0103] Feature extraction:

[0104] Basic features:

[0105] Forward hop count H_forward, reverse hop count H_reverse (label), RTT (round trip time), AS path length, probe time.

[0106] Derived features:

[0107] Hop asymmetry ratio: α = H_r / H_forward (reflects path asymmetry).

[0108] RTT / hop ratio: β = RTT / (H_forward+H_reverse) (estimate average delay per hop).

[0109] Shared link flag: judge whether it passes through the same ISP according to IP prefix (such as forward and reverse paths contain AS123).

[0110] Model selection and training;

[0111] (1) Model options

[0112] Linear regression: Quickly fit the hop count ratio relationship (e.g., H_reverse ≈ w·H_forward + b).

[0113] Random forest / Boost: Handle non-linear features (e.g., AS path, shared link).

[0114] LSTM: Suitable for time series prediction (e.g., periodic changes in path hop count).

[0115] (2) Training process

[0116] Data division: Split the training set (70%), validation set (20%), and test set (10%) by time window.

[0117] Feature standardization: Z-score normalization for numerical features such as RTT and hop count.

[0118] Loss function:

[0119] Mean squared error (MSE): L = (H_reverse_predicted - H_reverse_actual)^2, where H_reverse_predicted is the predicted reverse path hop count and H_reverse_actual is the actual reverse path hop count.

[0120] Customized weight: Add a penalty term for high asymmetry paths.

[0121] Dynamic compensation mechanism

[0122] (1) Online compensation

[0123] Real-time input: Current forward hop count H_forward_now, RTT, AS path.

[0124] Model output: Predicted reverse hop count H_reverse_predicted + confidence interval (e.g., 10 ± 1.2).

[0125] Compensation rules:

[0126] If the variance of H_forward_now corresponding to H_reverse in historical data is small, directly use the predicted value.

[0127] If the current RTT deviates significantly from the predicted value (e.g., more than ±15%), trigger a re-probe.

[0128] (2) Feedback learning

[0129] Data backfill: When real reverse hop count is obtained (e.g. cooperative node returns probe result), update training set.

[0130] Model retraining: Update model parameters periodically (e.g. daily) or triggered (e.g. when error exceeds threshold).

[0131] As shown in Figure 3 By comparing forward measured hop count (H_forward) and reverse estimated hop count (H_reverse), the system performs the following consistency verification and state diagnosis:

[0132] Path symmetry determination: In ideal fully symmetric routing, H_forward≈H_reverse should be met. The system sets a symmetry tolerance threshold θ_sym (usually 1-2 hops), and when |H_forward-H_reverse|≤θ_sym, it is determined as a symmetric path, and the hop count result is reliable.

[0133] Asymmetric path detection: When |H_forward-H_reverse|>θ_sym, it is determined that there is asymmetric routing. This is a common phenomenon in the Internet, and the system will record this state and consider this path difference in topology calculation.

[0134] Security threat detection: The core security value of this mechanism is to identify malicious forgery. The specific judgment logic is as follows:

[0135] Case A (man-in-the-middle attack or route hijacking): If the probe packet passes through a malicious node, the node tampers with the HopLimit field to pretend to be closer, which will cause H_forward to be abnormally small. At this time, even if the path itself is symmetric, H_forward+H_reverse<initial hop limit will appear as an abnormal case (because the initial hop limit-H_forward is the hop count to the attacker, not the hop count to the real target).

[0136] Case B (source routing forgery): Attackers may forge the source address of the probe packet for reflection attack. At this time, the response packet received by the system may not come from the original probe target. By comparing the behavior fingerprint or address prefix of the response packet IP and the target IP, if they are not consistent, it can be directly determined as path deception.

[0137] Specifically, the construction of the initial topology skeleton includes:

[0138] Define the fingerprint identification of the device as a topology node, and the hop count difference between devices as an edge weight;

[0139] By using the minimum spanning tree algorithm to preferentially select the path with the smallest hop count difference, a sparse initial topology skeleton is constructed;

[0140] Based on the initial topology skeleton, devices are grouped according to the prefix of the IPv6 address, and devices with the same prefix are preferentially allocated to the same sub-tree to form a logical sub-tree, so as to optimize the sparse initial skeleton into a hierarchical logical topology structure.

[0141] The logical sub-tree is used to represent different management domains or subnets in the final visual topology graph, and serves as a basis for judging abnormal communication behavior of devices.

[0142] In the embodiment, by topology sparsification and hierarchical grouping, the physical connection (based on the difference in hop count) and the logical relationship (based on the IPv6 prefix) between devices are combined to construct an efficient and semantically clear network topology structure. First, the fingerprint identifier of each device is used as a topology node, and the difference in hop count between devices is used as an edge weight, and the smaller the weight, the higher the connection quality. The minimum spanning tree (MST) algorithm (such as Kruskal or Prim algorithm) is used to select the edge with the smallest hop count difference to generate a sparse connection basic topology. According to the similarity of the IPv6 address prefix, devices with the same prefix are allocated to the same sub-tree (management domain). Here, a clustering algorithm can be used to divide devices into logical sub-trees (management domains) according to the prefix similarity and network distance. An example of the clustering algorithm is as follows:

[0143] Calculate the distance matrix between all devices;

[0144] Merge the two clusters with the closest distance, and update the matrix (single link / full link);

[0145] Stop merging according to the preset number of sub-trees or distance threshold.

[0146] Input: IPv6 prefix and hop count difference of 4 devices:

[0147] A: 2001:db8:1:: / 48, W_AB=0.1, W_AC=2.0, W_AD=1.8;

[0148] B: 2001:db8:1:: / 48, W_BA=0.1, W_BC=2.2, W_BD=1.9;

[0149] C: 2001:db8:2:: / 48, W_CA=2.0, W_CB=2.2, W_CD=0.3;

[0150] D: 2001:db8:2:: / 48, W_DA=1.8, W_DB=1.9, W_DC=0.3;

[0151] Clustering process:

[0152] Merge A and B (same prefix and (W_{AB}) minimum).

[0153] Merge C and D (same prefix and (W_{CD}) is minimum).

[0154] Stop (all remaining inter-cluster distances are greater than threshold 1.5).

[0155] Output logical subtrees:

[0156] Subtree 1: [A, B] (prefix 2001:db8:1:: / 48);

[0157] Subtree 2: [C, D] (prefix 2001:db8:2:: / 48).

[0158] Where the auxiliary data includes:

[0159] IPv6 address attribution information: operator-assigned prefix segments, ASN numbers, address cluster distribution, etc., preliminary division of network belonging scope;

[0160] Geographical location information: physical location of devices inferred through IP geolocation databases, delay measurements, or link characteristics;

[0161] Path hop count difference matrix: relative hop counts between target devices obtained from forward and reverse probing mechanisms, used to estimate topological proximity relationships.

[0162] In this embodiment, operator-assigned prefix segments: IPv6 addresses are usually assigned specific prefix segments by operators. For example, a certain operator may be assigned a prefix such as 2001:db8:100:: / 48. By identifying these prefix segments, we can preliminarily determine the operator scope to which the network devices belong. Networks of different operators may differ in topology, and this information helps to divide the network into different large areas.

[0163] ASN number (Autonomous System Number): Each autonomous system has a unique ASN number. An AS is a collection of networks under single technical management, which use the same routing protocol for internal and external communication. Through the ASN number, we can understand the autonomous system to which the network devices belong, and further infer the connection relationship between networks. For example, a large enterprise may have its own ASN, and its internal network devices belong to this autonomous system.

[0164] Address cluster distribution: IPv6 address clusters refer to address sets with similar characteristics. Analyzing the distribution of address clusters can help us understand the organizational structure of the network. For example, a data center may have a specific address cluster for servers and another address cluster for storage devices.

[0165] IP Geolocation Database: There are many commercial and open-source IP geolocation databases, such as Max Mind GeoIP. These databases record the approximate geographic location of devices based on IP addresses, including country, city, latitude and longitude, and other information. By querying these databases, the geographic location of devices can be quickly determined.

[0166] Delay Measurement: By measuring the network delay between devices, the physical distance between them can be inferred. Generally speaking, the larger the delay, the more likely the physical distance is farther apart. For example, the delay from a server in Beijing to a server in New York will usually be larger than to a server in Shanghai.

[0167] Link Characteristics Reverse: The characteristics of the link, such as bandwidth, packet loss rate, etc., can also be used to infer the physical location of the device. For example, high-speed optical fiber links are usually used to connect devices that are close together, while satellite links may be used to connect devices that are far apart.

[0168] Path Hop Count Difference Matrix: The forward and reverse probing mechanism can obtain the relative hop count between each target device. For example, the forward hop count from device A to device B is 5, and the reverse hop count is 6, so the hop count difference matrix between them records this information. The hop count reflects the number of intermediate nodes that data packets pass through from one device to another, and the more hops, the farther apart the two devices are in the topology.

[0169] The hop difference gap is taken as the core weight: the weight value is calculated as: 1 / (variance of hop measurement value + ε), where ε is a very small constant to avoid division by zero error, and the variance of the hop measurement value reflects the stability of the hop measurement. The smaller the variance, the more stable the hop measurement, and the greater the corresponding weight, meaning that the topology relationship between the two devices is more reliable. The behavior fingerprint can include features such as traffic patterns and protocol usage of the device. By calculating the similarity of the behavior fingerprints between devices, the core weight can be optimized. For example, if the traffic patterns of two devices are very similar, it means that their roles in the network may be similar, so the weight between them can be appropriately increased. The minimum spanning tree algorithm (such as Prim's algorithm or Krystal's algorithm) can construct a connected graph according to the weight matrix, so that the sum of the weights of all edges in the graph is minimized. In this process, the hop difference gap is taken as the core weight, and the weight matrix optimized by weighting the similarity of the behavior fingerprints is taken as the input. The minimum spanning tree algorithm will select the edge with the maximum weight (i.e. the most stable hop measurement and the highest behavior fingerprint similarity) to connect the devices, thereby constructing the initial topology skeleton. After obtaining the initial topology skeleton, clustering optimization is performed in combination with IPv6 address prefix information. Devices with the same or similar address prefixes are likely to belong to the same subnet or subnet set. By clustering these devices together, the topology structure can be further optimized to better match the actual network organization. For example, devices belonging to the same operator prefix segment are clustered together to form a subnet area, which can more clearly show the hierarchical structure of the network. Through the above steps, the accurate logical network topology structure can be recovered. This topology structure shows the connection relationship between devices in the network, including the relative position of the devices, the operator and subnet to which they belong, and other information. It can help network administrators better understand the organization structure of the network, perform troubleshooting, performance optimization, and other work. For example, when a device fails, the topology structure can be used to quickly locate the device in the subnet and adjacent devices, and analyze the possible scope of the failure.

[0170] Taking a campus IPv6 network as an example, the practical application process of the IPv6 lightweight network device mapping method based on behavior fingerprint and hop verification is described in detail:

[0171] S1: Device monitoring and data collection

[0172] A network sniffer (such as Wire shark) is deployed at the port of the campus network core switch to listen to the IPv6 network traffic in the campus. In a day, the sniffer collects a large amount of network traffic metadata. For example:

[0173] A student computer in Building A (source IPv6 address: 2001:db8:1:1::100) frequently communicates with the school library server (destination IPv6 address: 2001:db8:2:2::200) using HTTP (port number 80) from 9am to 10am. The packet size is between 500-1500 bytes, and there is a data interaction every few minutes.

[0174] An office computer in Building B (source IPv6 address: 2001:db8:3:3::300) communicates with the school mail server (destination IPv6 address: 2001:db8:4:4::400) multiple times using SMTP (port number 25) and IMAP (port number 143) protocols from 3pm to 4pm.

[0175] S2: Behavior Fingerprint Generation

[0176] Dynamic Weight Feature Selection: For the student computer in Building A, select its communication frequency (every 5 minutes), the protocol used (HTTP), the communication time period (9am-10am), and the packet size range (500-1500 bytes) as dynamic weight features. For the office computer, select its communication frequency (every 10 minutes), the protocols used (SMTP and IMAP), the communication time period (3pm-4pm), and the packet size range (300-800 bytes) as dynamic weight features.

[0177] Fingerprint Identification Generation: Use a hash algorithm (such as MD5) to combine these dynamic weight features to generate a unique fingerprint identification. For example, the fingerprint identification of the student computer in Building A is "abc123", and the fingerprint identification of the office computer is "def456".

[0178] S3: Multi-hop Path Probing

[0179] Forward Path Hop Count Calculation: Send an ICMPv6 Echo Request probe packet from the campus network management center server to the student computer in Building A. The probe packet passes through 3 routers before reaching the student computer, so the forward path hop count is 3. Similarly, send a probe packet to the office computer, which passes through 2 routers, so the forward path hop count is 2.

[0180] Return Path Hop Count Estimation: For the ICMPv6 Echo Reply packet returned by the student computer, since the specific return path cannot be directly known, based on the historical path measurement feature library accumulated locally, it is assumed that most of the paths in the campus network have certain symmetry, and the return path hop count is estimated to be 3. For the response packet returned by the office computer, the return path hop count is estimated to be 2.

[0181] Compensation model construction: Considering that some links in the campus network may have congestion or asymmetry, a compensation model is constructed based on historical measurement data. For example, it is found that the link from teaching building A to the management center server may have additional delay at certain time periods. The estimated value of the student computer return path hop count is compensated, and the final bidirectional path hop count estimate is 3.2 (3 hops in the forward direction and approximately 3.2 hops in the return path after considering compensation); the bidirectional path hop count estimate for the office computer is 2.

[0182] S4: Network topology construction

[0183] After obtaining the behavior fingerprints and path hop count information of the student computers, office computers, and other target devices in teaching building A, a network topology graph is constructed using graph theory algorithms such as the minimum spanning tree algorithm. The student computers, office computers, library servers, mail servers, and other devices are used as nodes, and the path hop count is used as the edge weight. For example, the edge weight between the student computer and the library server is 3.2 (bidirectional path hop count estimate), and the edge weight between the office computer and the mail server is 2. Meanwhile, the topology graph is optimized and adjusted in combination with the configuration information of the campus network devices (such as the location of the router, subnet division, etc.), making the topology structure more accurate and complete.

[0184] S5: Anomaly detection and visualization

[0185] Network topology visualization: The constructed campus network topology structure is displayed in graphical form using the Gephi tool, with nodes representing devices and edges representing the connection relationship between devices.

[0186] Anomaly detection: In the topology graph, a device located in the experimental building (fingerprint identifier: "ghi789") is found, with a bidirectional path hop count estimate of 8, which is significantly higher than the hop count of most other devices (usually between 2-4 hops), and its connection relationship is inconsistent with the surrounding nodes. The device frequently communicates with an unknown IP address outside the campus. Based on indicators such as node hop count, connection density, and behavior consistency, the device is determined to be an abnormal node.

[0187] Visualization display: In the visualized topology graph, the abnormal node (experimental building device) and its associated path are displayed in red, generating an interactive logical topology graph. The campus network administrator can view the detailed communication information and path hop count of the node by clicking on it, further investigating whether the device has security risks.

[0188] Through the above actual example of the campus IPv6 network, the specific application process of the IPv6 lightweight network device mapping method based on behavior fingerprint and hop count verification is demonstrated, helping network administrators to comprehensively understand the network structure and timely detect abnormal situations.

[0189] While the preferred embodiments of the application have been described, additional variations and modifications can be made to these embodiments by those skilled in the art once they have the benefit of the present disclosure without departing from the spirit and scope of the application. Accordingly, it is intended that the appended claims include all such modifications and variations as fall within the scope of the present application.

[0190] It is apparent that those skilled in the art can make various changes and modifications to the application without departing from the spirit and scope of the application. It is therefore intended that the present application cover all such changes and modifications that are within its scope.

Claims

1. A lightweight IPv6 network device mapping method based on behavioral fingerprinting and hop count verification, characterized in that, Includes the following steps: S1: Device monitoring and data acquisition: Collecting metadata of raw traffic in the IPv6 network; S2: Behavioral fingerprint generation: Select and process multi-dimensional feature vectors from metadata to generate a unique and stable fingerprint identifier for each device; S3: Bidirectional path hop count detection: The bidirectional path hop count includes the forward path hop count and the reverse path hop count. A probe packet is sent to the target device to calculate the forward path hop count. The path hop count returned by the response packet is estimated to obtain the reverse path hop count. The path is detected by comparing the forward path hop count and the reverse path hop count. S4: Network Topology Construction: Using fingerprint identifiers as topology nodes and bidirectional path hop count detection values ​​as topology edge weights between devices, an initial topology skeleton is constructed using the minimum spanning tree algorithm. Clustering optimization is then performed using auxiliary data to obtain the network topology structure. S5: Visualization: Automatically infers hierarchical relationships based on fingerprint identification, node hop count, connection tightness, and behavioral consistency, generating an interactive logical topology diagram to display abnormal nodes and associated paths; The behavioral fingerprint generation step includes: A local weighted hash algorithm is used to reduce the dimensionality of the multidimensional feature vector to generate device behavior fingerprints; firstly, the input multidimensional feature vector is processed... Assign weight vectors by dimension Generate weighted vectors , where n represents the nth multidimensional feature vector; Then, a locality-sensitive hash function was used. Mapping it to a fixed-length binary fingerprint, the function design satisfies: when the device behavior features are weighted by Euclidean distance ,in It is the threshold for normal network fluctuations. and These are the equipment and equipment The weighted vector, P is the device and equipment After hash function The probability that the results are the same after mapping.

2. The IPv6 lightweight network device mapping method based on behavioral fingerprinting and hop count verification according to claim 1, characterized in that, The calculation of the forward path hop count includes: Forward path hop count calculation: Send probe packets to the target device and calculate the forward path hop count by recording the number of routers the probe packets pass through; The calculation formula is: H_forward = Initial Hop Limit - Hop_Limit; Where H_forward is the number of hops on the forward path, Initial Hop Limit is the initial hop limit, and Hop_Limit is the response packet.

3. The IPv6 lightweight network device mapping method based on behavioral fingerprinting and hop count verification according to claim 1, characterized in that, The estimation of the reverse path hop count from the response packet return path hop count includes: For the response packet returned by the target device, estimation is performed based on the locally accumulated historical path measurement feature library, including: Build a historical database: record past bidirectional path hop count measurements for the same device; Extracted features: forward path hop count, reverse path hop count, RTT, AS path length and probe time, hop count asymmetry ratio, RTT / hop count ratio, and shared link flag; Real-time matching: Based on the current forward path hop count of the device, query the distribution of the corresponding reverse path hop count in the historical database; The compensation model uses dynamic compensation: it takes into account network asymmetry and shared links in real time to compensate for the estimated number of hops on the return path.

4. The IPv6 lightweight network device mapping method based on behavioral fingerprinting and hop count verification according to claim 3, characterized in that, The dynamic compensation of the compensation model includes: Real-time input: the aforementioned features; Model output: predicted reverse path hop count + confidence interval; If the variance of the reverse path hop count corresponding to the forward path hop count in the historical database is small, then the predicted value is used directly. If the current RTT deviates significantly from the predicted value, a reprobing is triggered.

5. The IPv6 lightweight network device mapping method based on behavioral fingerprinting and hop count verification according to claim 1, characterized in that, The construction of the initial topology skeleton includes: The fingerprint identifier of a device is defined as a topology node, and the difference in hop count between devices is defined as the edge weight. The minimum spanning tree algorithm is used to select the path with the smallest difference in hop count to construct a sparse initial topological skeleton. Based on the initial topology skeleton, devices are grouped according to the prefix of the IPv6 address. Devices with the same prefix are preferentially assigned to the same subtree to form a logical subtree, thereby optimizing the sparse initial skeleton into a hierarchical logical topology structure. The logical subtree is used to represent different management domains or subnets in the final visualized topology diagram and serves as a basis for judging abnormal device communication behavior.

6. The IPv6 lightweight network device mapping method based on behavioral fingerprinting and hop count verification according to claim 1, characterized in that, The auxiliary data includes: IPv6 address attribution information: prefix range, ASN number, address cluster distribution assigned by the operator, and preliminary division of the network's scope; Geographic location information: The physical location of the device is deduced by using IP geolocation databases, latency measurements, or link characteristics; Path hop count difference matrix: The relative hop count between each target device is obtained by forward and reverse probing mechanisms and is used to estimate the topology proximity.

Images