Large-scale IPv6 network node detection method based on self-learning algorithm

Abstract

The invention discloses a large-scale IPv6 network node detection method based on a self-learning algorithm, and relates to the technical field of IPv6 address detection. Comprising the following steps: S1, starting a detection process through an initial seed address set; s2, constructing a lightweight address generation model based on the verified initial seed address set, and generating a candidate IPv6 address set; s3, executing concurrent survival detection on the candidate IPv6 address set; s4, acquiring detection response data; and S5, inputting the detection response data into the lightweight address generation model, and carrying out online training and parameter updating on the lightweight address generation model. Structural features of active addresses are automatically learned through a multi-layer perceptron structure, and high hit rate and low redundancy of IPv6 address detection are achieved; through a concurrent detection and dynamic rate control strategy, the bottleneck problem of detection efficiency is effectively solved; and by introducing a multi-dimensional feedback signal and a refined loss function, the adaptive capacity of the system is enhanced.

Description

Technical Field

[0001] This invention relates to the field of IPv6 address detection technology, and in particular to a large-scale IPv6 network node detection method based on a self-learning algorithm. Background Technology

[0002] With the rapid development of internet technology and the increasing depletion of IPv4 address resources, the large-scale deployment of IPv6 (Internet Protocol version 6), as the core protocol of the next-generation internet, has become an inevitable trend in global network development. The IPv6 address space has 2^128 addresses. While its massive address space provides ample unique identifiers for network devices, it also brings unprecedented challenges to fundamental tasks such as topology discovery, asset mapping, and security monitoring of core network infrastructure.

[0003] Against this backdrop, accurate and efficient detection of large-scale IPv6 network nodes has become a key technology for network space cognition and security management. However, due to the vast size of the IPv6 address space, traditional detection methods (such as mature port scanning and topology discovery techniques used in IPv4 networks) are difficult to apply directly. Existing detection methods for IPv6 networks can generally be categorized as follows: (1) Static scanning detection technology This type of technology, represented by tools such as Yarrp6 and Scamper, revolves around traversing or sampling a known or pre-defined range of IPv6 addresses. While asynchronous packet processing and hop count optimization (such as the Doubletree algorithm) improve detection efficiency to some extent, it remains essentially a blind or semi-blind scanning strategy. In a sparsely distributed active IPv6 address space, this method generates a large number of invalid probes, resulting in extremely low detection efficiency and making it difficult to achieve rapid coverage of large-scale networks within limited time and bandwidth budgets.

[0004] (2) Dynamic seed guidance detection technology To improve probe hit rate, techniques such as 6Search and TopoMiner attempt to use known live addresses (seed addresses) to guide subsequent probe directions. They analyze the distribution characteristics of seed addresses (such as density and entropy) or use reinforcement learning to dynamically allocate probe resources, prioritizing the scanning of address regions with high response probabilities. While these methods alleviate the problem of blindness to some extent, their data processing is complex and iteration cycles are long, severely limiting the probe rate and making it difficult to meet the needs of rapid response in ultra-large-scale networks.

[0005] (3) Pattern generation-based detection technology In recent years, some studies have begun to explore using machine learning methods (such as address entropy analysis in Entropy / IP, graph clustering in 6Graph, and variational autoencoders in 6GCVAE) to learn allocation patterns from seed addresses and generate new candidate addresses for probing. These methods have shown high hit potential in specific scenarios, but generally suffer from the following limitations: First, the generation process is separate from the probing action, failing to form an effective closed-loop feedback; second, the models largely rely on the static features of historical seed data and cannot adapt to dynamic changes in network state; finally, the complex models also lead to high computational overhead, affecting overall probing efficiency.

[0006] In summary, existing IPv6 network node detection technologies suffer from the following problems: ① inefficiency due to blind scanning; ② inability to meet the demands of rapid detection in large-scale networks due to complex algorithms and slow response times; ③ a general lack of ability to continuously learn and self-optimize from actual network feedback. Therefore, there is an urgent need to develop a novel IPv6 network node detection method. Summary of the Invention

[0007] To address the shortcomings of existing technologies, this invention provides a large-scale IPv6 network node detection method based on a self-learning algorithm. By automatically learning the structural characteristics of active addresses through a multilayer perceptron structure, it achieves high hit rate and low redundancy in IPv6 address detection. Through concurrent detection and dynamic rate control strategies, it effectively solves the detection efficiency bottleneck problem. By introducing multi-dimensional feedback signals and a refined loss function, it enhances the system's adaptive capability.

[0008] In a first aspect, the present invention provides a method for large-scale IPv6 network node detection based on a self-learning algorithm, comprising: S1. Collect an initial seed address set and perform format verification. The initial seed address set is provided by historical detection records, public registration information, or third-party data sources. S2. Based on the verified initial seed address set, a lightweight address generation model is constructed, and a candidate IPv6 address set is generated; the lightweight address generation model adopts a multilayer perceptron structure; S3. Perform concurrent liveness detection on the candidate IPv6 address set. The concurrent liveness detection is used to determine active addresses by asynchronously sending ICMPv6 echo request messages and listening for ICMPv6 echo reply messages within a preset time window. S4. Collect the detection response data of active addresses, including the active address list, response delay sequence, packet loss rate and address space distribution density map; S5. Input the probe response data into the lightweight address generation model, and perform online training and parameter updates on the lightweight address generation model; S6. Repeat steps S3-S5 to iteratively update the lightweight address generation model until the preset termination condition is met. S7. After verifying the initial seed address set for the next collection, input it into the lightweight address generation model and output the final detection result. The final detection result includes the final active address set, response feature parameters, and the convergence status of the detection process.

[0009] Optionally, the multilayer perceptron structure further includes: The multilayer perceptron structure includes an input layer, a hidden layer, and an output layer; The input layer is used to obtain and process the verified initial seed address set; wherein, the bytes of the IPv6 address are mapped to an eight-dimensional one-hot encoded vector to form a 128-dimensional input feature; The hidden layer employs a sparse activation function to compress the 128-dimensional input features into a low-dimensional latent space, thereby achieving nonlinear feature extraction. The hidden layer neurons adopt a grouped sparse connection structure, which divides the 128-dimensional input features into four independent processing channels. The channels interact with each other through a cross-segment attention mechanism. The output layer adopts a conditional probability sampling mechanism, calculates the generation probability of candidate addresses based on the current model parameters, and performs non-uniform sampling according to the generation probability distribution to output a set of candidate IPv6 addresses.

[0010] Optionally, S3 further includes: A batch of addresses to be probed is extracted from the candidate IPv6 address set, the number of which is determined by the current system resource status; The address to be probed is encapsulated into an ICMPv6 echo request message, the header of which includes the source address, the destination address, the identifier, and the sequence number. The ICMPv6 echo request message is sent asynchronously through the raw socket interface without blocking the main thread; After sending, start a timer with a preset time window to listen for ICMPv6 echo reply messages at the corresponding target address; If a matching ICMPv6 echo reply message is received within the time window, the address to be probed is determined to be an active address, and its response delay and message content are recorded; if no reply is received within the time window, it is marked as no response.

[0011] Optionally, S3 further includes: The system is configured to retry a maximum of two times for each address to be probed; A dynamic rate control strategy is adopted to adjust the probe packet sending rate based on the current network load status and historical response success rate. The dynamic rate control strategy calculates the average response rate of the probe based on a sliding window statistical model and adjusts the transmission interval accordingly. Write the detection results to a temporary results buffer.

[0012] Optionally, S4 further includes: Extract all probe results, filter out the addresses marked as active, and form a list of active addresses; Extract the response latency corresponding to the active address to form a response latency sequence; Quantile statistics were performed on the response delay sequence, and the 10%, 50%, and 90 percentiles were extracted as network status evaluation indicators. Among them, the 10 percentile reflects the optimal response performance, the 50 percentile represents the median response level, and the 90 percentile indicates the tail delay. Calculate the message loss rate for this round of detection; Active addresses are grouped according to their hexadecimal prefixes, and the number of active addresses in each group is counted to form an address space distribution density map.

[0013] Optionally, S5 further includes: The detection response data is deconstructed into monitoring signals and auxiliary features; the monitoring signals include a list of active addresses; the auxiliary features include a response delay sequence and an address space distribution density map, which are used for the weighted loss function. The model update uses the gradient descent optimization algorithm, and each update uses 256 active addresses for computation, with an initial learning rate of 0.01. The loss function is defined as the KL divergence between generated addresses and active addresses in the latent space, supplemented by a time delay weighting term; wherein, the KL divergence is used to measure the difference between the distribution of addresses generated by the model and the distribution of real active addresses; The update process introduces a momentum term and a learning rate decay mechanism. The momentum term coefficient is set to 0.9, and the learning rate decay adopts an exponential decay function.

[0014] Optionally, the loss function and the learning rate decay calculation formula are expressed as follows: ; ; In the formula, Distribution of active addresses, Generate a probability distribution of addresses for the model. For the first Response latency of an active address For the first Normalized weights of active addresses, The delay penalty coefficient is set to 0.1; The initial learning rate, The attenuation coefficient is initially set to 0.0001. This represents the current detection round number.

[0015] Optionally, S6 further includes: The detection process is an iterative closed-loop structure, with each round of detection based on the results of the previous round of model updates; After the model completes one round of updates, the currently active addresses are used as the new seed address set to generate the next round of candidate address set. During the generation process, the model calculates the generation probability of the next round of candidate address set based on the latest parameters, and performs non-uniform sampling according to the probability distribution; The preset termination conditions include: the number of probe rounds reaches the upper limit; the growth rate of newly active addresses is lower than the threshold; and system resource consumption reaches the budget limit. When any preset termination condition is met, the system triggers the termination of the detection process.

[0016] Optionally, S7 further includes: Merge the active address lists from all rounds, remove duplicates, and generate the final complete set of active addresses; Response characteristic parameters are attached to each active address, including the first probe round, minimum response latency, average response latency, maximum response latency, and number of probes. Record the convergence status of the probing process; if it terminates due to the growth rate of new addresses being lower than the threshold, it is marked as natural convergence; if it terminates due to the round limit, it is marked as forced termination; if it terminates due to resource overrun, it is marked as resource-limited termination. The list of active addresses is sorted in ascending order of response latency.

[0017] Secondly, the present invention also provides a large-scale IPv6 network node detection system based on a self-learning algorithm, which applies the large-scale IPv6 network node detection method based on a self-learning algorithm as described above. The system includes an initial seed processing module, an address generation module, a concurrent detection module, a data acquisition module, a model update module, an iteration control module, and a result output module. The initial seed processing module is used to collect the initial seed address set and perform format verification; The address generation module is used to construct and run a lightweight address generation model based on the verified initial seed address set to generate a candidate IPv6 address set. The concurrent detection module is used to perform concurrent liveness detection on the candidate IPv6 address set; it determines active addresses by asynchronously sending ICMPv6 echo request messages and listening for ICMPv6 echo reply messages within a preset time window. The data acquisition module is used to collect detection response data for active addresses. The detection response data includes an active address list, response delay sequence, packet loss rate, and address space distribution density map. The model update module is used to input the probe response data into the lightweight address generation model, and to perform online training and parameter updates on the lightweight address generation model to minimize the distribution difference between the generated addresses and the actual active addresses. The iterative control module is used to control the repeated execution of the detection, acquisition and update process, and iteratively optimize the lightweight address generation model until the preset termination condition is met. The result output module is used to input the initial seed address set of the next collection into the lightweight address generation model after verification, and output the final detection result. The final detection result includes the final active address set, response feature parameters and the convergence status of the detection process.

[0018] Compared with the prior art, the present invention has the following advantages and beneficial effects: 1. By adopting a lightweight address generation model and intelligent sampling mechanism, the detection efficiency is greatly improved. The structure characteristics of active addresses are automatically learned through the multilayer perceptron structure, and the conditional probability sampling mechanism is used to prioritize the generation of high-probability candidate addresses, avoiding the waste of resources caused by uniform random scanning. This achieves a balance between high hit rate and low redundancy in the ultra-large-scale IPv6 address space.

[0019] 2. By employing concurrent probing and dynamic rate control strategies, the system effectively addresses the probing efficiency bottleneck. An asynchronous message engine manages several concurrent probing sessions, and combined with dynamic rate control based on sliding window statistics, it intelligently adjusts the sending rate according to network load conditions, ensuring both timely probing and avoiding overloading the target network.

[0020] 3. The introduction of multi-dimensional feedback signals and refined loss functions enhances the system's adaptability. In addition to utilizing the active address list as a monitoring signal, it innovatively introduces response latency and spatial distribution characteristics as auxiliary optimization indicators. By combining KL divergence loss with a latency-weighted composite objective function, the model can gradually approximate the active address distribution characteristics in the real network environment.

[0021] In summary, this application effectively solves the technical challenges faced in large-scale IPv6 network probing, such as huge state space, low probing efficiency, and insufficient adaptive capability, providing reliable technical support for achieving efficient, accurate, and adaptive IPv6 network mapping. Attached Figure Description

[0022] Figure 1 This is a flowchart illustrating a large-scale IPv6 network node detection method based on a self-learning algorithm.

[0023] Figure 2 This is a schematic diagram of the data flow and control flow interaction relationship between the various functional modules of the detection system in this invention.

[0024] Figure 3 This is a block diagram of a large-scale IPv6 network node detection system based on a self-learning algorithm. Detailed Implementation

[0025] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention. It should be noted that relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0026] Example 1 Please see Figures 1-2 This invention provides a large-scale IPv6 network node detection method based on a self-learning algorithm. Its core lies in constructing a closed-loop dynamic detection architecture, using real-time detection feedback data as the driving source to drive a lightweight generation model to continuously iterate and optimize the candidate address generation strategy. This achieves high hit rate, low redundancy, and strong adaptability in the ultra-large-scale IPv6 address space. The method abandons the traditional separate architecture of static scanning and offline modeling, establishing a real-time coupling mechanism between detection actions and model learning. This allows the system to dynamically adjust the detection direction based on network response, significantly improving detection efficiency and coverage. The method includes the following steps: S1. Collect an initial seed address set and perform format verification. The initial seed address set is provided by historical detection records, public registration information, or third-party data sources. Understandably, given the vast size of the IPv6 address space, performing a full-space scan without any prior knowledge would be computationally and time-consuming. Therefore, this application relies on an initial seed address set as the starting point for probing. This initial seed address set includes historical probe records, publicly available registration information, and third-party data sources. Historical probe records refer to confirmed active addresses accumulated from past probe missions. Publicly available registration information refers to allocated address ranges or registered network prefixes published by regional internet registries; while this information does not guarantee address activity, it can serve as a high-probability candidate region. Third-party data sources refer to DNS records, routing table snapshots, security scan data, or shared academic research materials that have undergone validity verification. After obtaining the initial seed address set, it is necessary to perform format validation and deduplication to ensure that all addresses conform to the IPv6 standard format. The validated initial seed address set is written into the initial address buffer as the first round of input for the lightweight address generation model.

[0027] S2. Based on the verified initial seed address set, a lightweight address generation model is constructed, and a candidate IPv6 address set is generated; the lightweight address generation model adopts a multilayer perceptron structure; Understandably, traditional IPv6 detection methods often rely on fixed rules or static models to generate candidate addresses, lacking the ability to adapt to dynamic changes in the network. This application introduces a lightweight address generation model, whose core objective is to automatically extract structural patterns from the verified initial seed address set through machine learning methods and generate a set of candidate IPv6 addresses with a high hit probability.

[0028] Specifically, the multilayer perceptron structure includes an input layer, a hidden layer, and an output layer. The input layer is used to obtain and process the verified initial seed address set. Each IPv6 address consists of 16 bytes, with each byte ranging from 0 to 255. To facilitate model processing, each byte is mapped to an eight-dimensional one-hot encoded vector, forming a 128-dimensional input feature. The hidden layer uses a sparse activation function to compress the 128-dimensional input feature into a low-dimensional latent space, achieving nonlinear feature extraction. The number of neurons in the hidden layer is set to 128, and a grouped sparse connection structure is used to divide the 128-dimensional input feature into four independent processing channels. Each channel corresponds to a 32-dimensional IPv6 address. The channels interact with each other through a cross-segment attention mechanism to capture the structural dependencies between address segments. The output layer uses a conditional probability sampling mechanism to calculate the generation probability of each candidate address based on the current model parameters and performs non-uniform sampling according to the generation probability distribution, prioritizing the output of high-probability candidate IPv6 address sets to avoid the waste of detection resources caused by uniform random generation.

[0029] S3. Perform concurrent liveness detection on the candidate IPv6 address set. The concurrent liveness detection determines whether the candidate IPv6 address is an active address by asynchronously sending ICMPv6 echo request messages and listening for ICMPv6 echo reply messages within a preset time window. Understandably, detection efficiency is the core bottleneck in large-scale IPv6 network mapping. Traditional serial detection methods cannot meet the timeliness requirements. Therefore, this application adopts a concurrent liveness detection mechanism, which manages multiple detection sessions simultaneously through an asynchronous packet engine.

[0030] Specifically, S3 also includes: Extract a batch of addresses to be probed from the candidate IPv6 address set. The number is determined by the current system resource status and is usually set to five thousand to ten thousand. The address to be probed is encapsulated into an ICMPv6 echo request message, the header of which includes the source address, the destination address, the identifier, and the sequence number. The ICMPv6 echo request message is sent asynchronously through the raw socket interface without blocking the main thread; After sending, start a timer with a preset time window of two seconds to listen for ICMPv6 echo reply messages at the corresponding target address; If a matching ICMPv6 echo reply message is received within the time window, the address to be probed is determined to be an active address, and its response delay and message content are recorded; if no reply is received within the time window, it is marked as no response.

[0031] Specifically, S3 also includes: The system is configured to retry a maximum of two times for each address to be probed, with a retry interval of 1 second; During the probe, the system monitors the network load status in real time and adopts a dynamic rate control strategy to adjust the probe packet sending rate according to the current network load status and historical response success rate. The dynamic rate control strategy is based on a sliding window statistical model, which calculates the average response rate of the most recent rounds of detection and adjusts the transmission interval linearly accordingly. If the average response rate is higher than 80%, the sending interval is shortened to 50 milliseconds; if it is lower than 20%, it is extended to 200 milliseconds to avoid overloading the target network. All detection results are written to a temporary results buffer.

[0032] S4. Collect the detection response data of active addresses, including the active address list, response delay sequence, packet loss rate and address space distribution density map; Understandably, the probe response data is the core feedback signal that drives the model's self-learning, and its quality and completeness directly affect the direction of model optimization. After each round of probe, the system automatically starts the data acquisition process.

[0033] Specifically, S4 includes: Extract all probe results from the temporary results buffer, filter out the addresses marked as active, and form a list of active addresses; Extract the response latency corresponding to each active address to form a response latency sequence; Quantile statistics were performed on the response delay sequence, and the 10%, 50%, and 90 percentiles were extracted as network status evaluation indicators. Among them, the 10 percentile reflects the optimal response performance, the 50 percentile represents the median response level, and the 90 percentile indicates the tail delay. Calculate the packet loss rate of this round of probing, which is the proportion of the number of addresses with no response to the total number of probing addresses; Construct an address space distribution density map by grouping active addresses according to their hexadecimal prefixes, counting the number of active addresses in each group, and forming an address space distribution density map.

[0034] S5. Input the probe response data into the lightweight address generation model, and perform online training and parameter updates on the lightweight address generation model to minimize the distribution difference between the generated addresses and the actual active addresses. Understandably, the online updating of the model parameters is a key step in realizing self-learning capabilities, with the goal of making the distribution of candidate addresses generated by the model gradually approximate the distribution of real active addresses.

[0035] Specifically, S5 includes: The detection response data is deconstructed into monitoring signals and auxiliary features; the monitoring signals include a list of active addresses; the auxiliary features include a response delay sequence and an address space distribution density map, which are used for the weighted loss function. The model update uses the gradient descent optimization algorithm, and each update uses 256 active addresses for computation, with an initial learning rate of 0.01. The loss function is defined as the KL divergence between generated addresses and active addresses in the latent space, supplemented by a latency weighting term. The KL divergence measures the difference between the distribution of addresses generated by the model and the distribution of real active addresses. The latency weighting term is an optimization term designed to allow the model to learn to generate active addresses while also slightly favoring the generation of addresses with faster response times. The calculation formula is shown below: ; In the formula, Distribution of active addresses, Generate a probability distribution of addresses for the model. For the first Response latency of an active address For the first Normalized weights of active addresses, The delay penalty coefficient is set to 0.1.

[0036] The update process incorporates a momentum term and a learning rate decay mechanism; the momentum term coefficient is set to 0.9 to smooth the gradient direction and avoid parameter oscillations; the learning rate decay uses an exponential decay function, calculated as follows: ; In the formula, The initial learning rate, The attenuation coefficient is initially set to 0.0001. For the current probe round, each round of updates will perform ten iterations. In each iteration, 256 active addresses will be randomly sampled as training samples. After the update is completed, the weights of the updated model will be saved and the memory of the old model will be released to ensure efficient use of resources.

[0037] S6. Repeat steps S3-S5, iteratively updating the lightweight address generation model until the preset termination conditions are met, including: The detection process is an iterative closed-loop structure, with each round of detection based on the results of the previous round of model updates; After the model completes one round of updates, the currently active addresses are used as the new seed address set to generate the next round of candidate address set. During the generation process, the model calculates the generation probability of the next round of candidate address set based on the latest parameters, and performs non-uniform sampling according to the probability distribution, prioritizing the selection of high-probability regions; Repeat steps S3-S5 until the detection process meets the preset termination condition. The preset termination conditions include: the number of probe rounds reaches the upper limit; the growth rate of newly active addresses is lower than the threshold; and system resource consumption reaches the budget limit. When any preset termination condition is met, the system triggers the termination of the detection process.

[0038] S7. After verifying the initial seed address set for the next collection, input it into the lightweight address generation model and output the final detection result. The final detection result includes the complete set of final active addresses, response feature parameters, and the convergence status of the detection process; including: Merge the active address lists from all rounds, remove duplicates, and generate the final complete set of active addresses; Response characteristic parameters are attached to each active address, including the first probe round, minimum response latency, average response latency, maximum response latency, and number of probes. Record the convergence status of the probing process; if it terminates due to the growth rate of new addresses being lower than the threshold, it is marked as natural convergence; if it terminates due to the round limit, it is marked as forced termination; if it terminates due to resource overrun, it is marked as resource-limited termination. The list of active addresses is sorted in ascending order of response latency.

[0039] Example 2 Please see Figures 2-3 The present invention also provides a large-scale IPv6 network node detection system based on a self-learning algorithm, which applies the large-scale IPv6 network node detection method based on a self-learning algorithm as described above. The system includes an initial seed processing module, an address generation module, a concurrent detection module, a data acquisition module, a model update module, an iteration control module, and a result output module. The initial seed processing module is used to collect the initial seed address set and perform format verification; The address generation module is used to construct and run a lightweight address generation model based on the verified initial seed address set to generate a candidate IPv6 address set. The concurrent detection module is used to perform concurrent liveness detection on the candidate IPv6 address set; it determines active addresses by asynchronously sending ICMPv6 echo request messages and listening for ICMPv6 echo reply messages within a preset time window. The data acquisition module is used to collect detection response data for active addresses. The detection response data includes an active address list, response delay sequence, packet loss rate, and address space distribution density map. The model update module is used to input the probe response data into the lightweight address generation model, and to perform online training and parameter updates on the lightweight address generation model to minimize the distribution difference between the generated addresses and the actual active addresses. The iterative control module is used to control the repeated execution of the detection, acquisition and update process, and iteratively optimize the lightweight address generation model until the preset termination condition is met. The result output module is used to input the initial seed address set of the next collection into the lightweight address generation model after verification, and output the final detection result. The final detection result includes the final active address set, response feature parameters and the convergence status of the detection process.

[0040] All content not described in detail in this specification is prior art known to those skilled in the art, and the model parameters of each electrical appliance are not specifically limited; conventional equipment can be used. Electrical control components not mentioned in this technical solution are not shown in the figures because they are prior art, and will not be described further here.

[0041] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A large-scale IPv6 network node probing method based on a self-learning algorithm, characterized in that, The method comprises the steps of: S1, collecting an initial seed address set and performing format verification, wherein the initial seed address set is provided by historical detection records, public registration information or a third-party data source; S2, constructing a lightweight address generation model based on the verified initial seed address set, and generating a candidate IPv6 address set; the lightweight address generation model adopts a multi-layer perception structure; S3, performing a concurrent survival detection on the candidate IPv6 address set, wherein the concurrent survival detection is performed by asynchronously sending an ICMPv6 echo request packet and listening to an ICMPv6 echo response packet within a preset time window to determine a live address; S4, collecting detection response data of the live address, wherein the detection response data comprises a live address list, a response time delay sequence, a packet loss rate and an address space distribution density atlas; S5, inputting the detection response data into the lightweight address generation model, and performing online training and parameter updating on the lightweight address generation model; S6, repeating steps S3-S5 to iteratively update the lightweight address generation model until a preset termination condition is met; S7, inputting the next collected initial seed address set into the lightweight address generation model after verification, and outputting a final detection result, wherein the final detection result comprises a final live address set, response characteristic parameters and a detection process convergence state. 2.The large-scale IPv6 network node probe based on self-learning algorithm according to claim 1, characterized in that: The multi-layer perception structure comprises: The multi-layer perception structure comprises an input layer, a hidden layer and an output layer; The input layer is used for acquiring and processing the verified initial seed address set; wherein the bytes of an IPv6 address are mapped into an eight-dimensional one-hot encoding vector to form 128-dimensional input features; The hidden layer adopts a sparse activation function and is used for compressing the 128-dimensional input features into a low-dimensional hidden space for nonlinear feature extraction; wherein the hidden layer neurons adopt a grouped sparse connection structure, the 128-dimensional input features are divided into four independent processing channels, and the features are interacted between the channels through a cross-section attention mechanism; The output layer adopts a conditional probability sampling mechanism, calculates the generation probability of a candidate address according to the current model parameters, and performs non-uniform sampling according to the generation probability distribution to output the candidate IPv6 address set. 3.The large-scale IPv6 network node probe based on self-learning algorithm according to claim 2, characterized in that: The S3 further comprises: A plurality of to-be-detected addresses are extracted from the candidate IPv6 address set, and the number is determined by the current system resource state; The to-be-detected addresses are encapsulated into ICMPv6 echo request packets, wherein the header of the ICMPv6 echo request packet comprises a source address, a target address, an identifier and a sequence number; The ICMPv6 echo request packet is sent asynchronously through a raw socket interface without blocking the main thread; After sending, a timer is started, and a preset time window is used to listen to the ICMPv6 echo response packet corresponding to the target address; If a matched ICMPv6 echo response packet is received within the time window, the to-be-detected address is determined as a live address, and the response time delay and the packet content are recorded; if no response is received within the time window, the to-be-detected address is marked as non-responsive.

4. The large-scale IPv6 network node probing based on self-learning algorithm according to claim 3, characterized in that: The S3 further comprises: The system sets that each to-be-detected address is retried at most twice. The dynamic rate control strategy is used to adjust the sending rate of the probe message according to the current network load state and the historical response success rate; The dynamic rate control strategy is based on a sliding window statistical model to calculate the average response rate of the probe and adjust the sending interval; The probe result is written into a temporary result buffer.

5. The large-scale IPv6 network node probing based on self-learning algorithm according to claim 4, characterized in that: The S4 further comprises: All probe results are extracted, and the addresses marked as active are screened to form an active address list; The response delay corresponding to the active address is extracted to form a response delay sequence; The response delay sequence is subjected to quantile statistics, and the tenth percentile, the fiftieth percentile and the ninetieth percentile are extracted as network state evaluation indexes; wherein the tenth percentile reflects the optimal response performance, the fiftieth percentile represents the median response level, and the ninetieth percentile indicates the tail delay situation; The packet loss rate of the current round of probe is calculated; The active addresses are grouped according to their hexadecimal prefixes, and the number of active addresses in each group is counted to form an address space distribution density map.

6. The large-scale IPv6 network node probing based on self-learning algorithm according to claim 5, characterized in that: The S5 further comprises: The probe response data is deconstructed into a supervision signal and auxiliary features; the supervision signal includes the active address list; the auxiliary features include the response delay sequence and the address space distribution density map, which are used to weight the loss function; The model update adopts a gradient descent optimization algorithm, and 256 active addresses are used for calculation each time the update is performed, and the initial value of the learning rate is 0.01; The loss function is defined as the KL divergence of the generated address and the active address in the hidden space, supplemented by a delay weighting term; wherein the KL divergence is used to measure the difference between the address distribution generated by the model and the distribution of the real active address; The update process introduces a momentum term and a learning rate decay mechanism, and the momentum term coefficient is set to 0.9, and the learning rate decay adopts an exponential decay function.

7. The large-scale IPv6 network node probing based on self-learning algorithm according to claim 6, characterized in that: The loss function and the learning rate decay calculation formula are as follows: ； ； wherein, is the distribution of active addresses, is the probability distribution of generating addresses for the model, is the response latency of the active address, is the normalized weight of the active address, is the latency penalty coefficient, set to 0.1; is the initial learning rate, is the decay coefficient, initially set to 0.0001, is the current round of exploration.

8. The large-scale IPv6 network node probing based on self-learning algorithm according to claim 7, characterized in that: The S6 further comprises: The probe process is an iterative closed-loop structure, and each round of probe is based on the previous round of model update result; After one round of model update is completed, the current active address is input as a new seed address set to generate a next round of candidate address set; During the generation process, the model calculates the generation probability of the next round of candidate address set according to the latest parameters, and performs non-uniform sampling according to the probability distribution; The preset termination conditions include: the number of probe rounds reaches an upper limit; the growth rate of newly added active addresses is lower than a threshold value; the system resource consumption reaches an upper limit of the budget; When any of the preset termination conditions is met, the system triggers the termination of the probe process.

9. The large-scale IPv6 network node probing based on self-learning algorithm according to claim 8, characterized in that: The S7 further comprises: All rounds of active address lists are merged, and duplicate items are removed to generate a final active address universe; Response feature parameters are added to each active address, including the first probe round, the minimum response delay, the average response delay, the maximum response delay and the number of probes; The convergence state of the probe process is recorded; if it is terminated because the growth rate of newly added addresses is lower than the threshold value, it is identified as natural convergence; if it is terminated because the number of rounds reaches the upper limit, it is identified as forced termination; if it is terminated because the resource consumption exceeds the upper limit, it is identified as resource-limited termination; The active address list is arranged in ascending order of response delay.

10. A large-scale IPv6 network node probing system based on self-learning algorithm, applying a large-scale IPv6 network node probing method based on self-learning algorithm as claimed in claims 1-9, characterized in that: The system comprises an initial seed processing module, an address generation module, a concurrent detection module, a data acquisition module, a model updating module, an iteration control module and a result output module; The initial seed processing module is configured to collect an initial seed address set and perform format verification; The address generation module is configured to construct and run a lightweight address generation model based on the verified initial seed address set, and generate a candidate IPv6 address set; The concurrent detection module is configured to perform concurrent survival detection on the candidate IPv6 address set, send ICMPv6 echo request packets asynchronously, and listen to ICMPv6 echo response packets within a preset time window to determine active addresses; The data acquisition module is configured to collect detection response data of the active addresses, wherein the detection response data comprises an active address list, a response delay sequence, a packet loss rate and an address space distribution density atlas; The model updating module is configured to input the detection response data into the lightweight address generation model, and perform online training and parameter updating on the lightweight address generation model to minimize the distribution difference between the generated addresses and the actual active addresses; The iteration control module is configured to control repeated execution of the detection, collection and updating processes, and iteratively optimize the lightweight address generation model until a preset termination condition is met; The result output module is configured to input the next collected initial seed address set into the lightweight address generation model after verification, and output a final detection result, wherein the final detection result comprises a final active address set, response characteristic parameters and a detection process convergence state.

Images