An ipv6 full response prefix detection method based on an autoregressive model

Abstract

The application provides an IPv6 full-response prefix detection method based on an autoregressive model, which comprises the following steps: firstly, semantic learning is performed by using the autoregressive model to learn the complex relationship between the full-response prefix mode and related factors, and the learned probability model is finally used to generate the representation of the full-response prefix mode; then, in the prediction stage, the possible full-response prefix mode is predicted according to the semantic information of the routing prefix, and the candidate full-response prefix is generated; finally, in the scanning stage, the candidate full-response prefix is scanned online, the detection results are collected, and whether the candidate full-response prefix is a real full-response prefix is judged according to the detection results; the granularity correction is performed on the real full-response prefixes, the prefix set with a real length is obtained, and a full-response prefix database with wide coverage and high accuracy is constructed.

Description

Technical Field

[0001] This invention relates to the field of prefix detection technology, and in particular to an IPv6 full response prefix detection method based on an autoregressive model. Background Technology

[0002] Network scanning across the internet, as a core technology in cyberspace resource mapping, actively sends customized probe packets to obtain the response characteristics of target networks. Tools like ZMap, for example, achieve high-performance active address scanning. These technologies are used to study internet infrastructure security, conduct geolocation analysis, and analyze the internet's impact on the real world, providing fundamental data support and playing a crucial role in network measurement. However, with the large-scale deployment of the IPv6 protocol, the vast address space created by its 128-bit address space presents new challenges for network scanning. More importantly, within this vast address space, there exists a special type of prefix—the full response prefix. This prefix also covers a large portion of the address space, and all addresses will respond to the scan. For example, if sending IMCPv6Echo messages to all addresses under a target prefix will receive ICMPv6Reply messages, then this prefix can be considered a full response prefix for ICMPv6 messages. However, it is obvious that these addresses cannot correspond to a single host.

[0003] Full response prefixes have significantly impacted the commonly used target generation-based scanning methods in active address probing, a current research hotspot. For example, all addresses under a / 32 prefix have a total of "2 96 "All addresses are considered active addresses. Furthermore, these non-real addresses (hosts) also impact other scanning tasks under IPv6; for example, scanners might mistake ports of multiple addresses in the full response prefix for different services. The widespread deployment of full response prefixes implies their special uses: such as running multiple services on a single server, CDN providers using full response prefixes for server load balancing, and security organizations deploying full response prefix honeypot systems. Therefore, understanding the global deployment of full response prefixes is increasingly crucial for improving network scanning quality and laying the foundation for utilizing full response prefixes, making it key to conducting new network scanning research."

[0004] Previous research has identified such prefixes in active address probing. To avoid the impact of these prefixes on active address probing, they proposed a MAPD-based method for identifying them. However, the core of MAPD is an enumeration method that randomly generates a certain number of candidate addresses and probes them, which has limited effectiveness in the vast IPv6 address space. Furthermore, MAPD can only probe when there is a seed address (i.e., an active IPv6 address), and is not suitable for full-response prefix probing across the entire network. Therefore, Cheng et al. proposed Luori, aiming to efficiently discover full-response prefixes across the entire network through active probing. Its core idea is to transform the full-response prefix probing problem into a reinforcement learning task using Monte Carlo trees.

[0005] However, full-response prefix detection still faces the following main problems:

[0006] (1) Huge decision space: The detection of the full response prefix requires 2 128 Predicting a prefix within a space, a / 80 prefix requires determining a pattern space of up to 2. 80 There are several possibilities. In existing work, MAPD uses an enumeration method to probe full response prefixes of a specific length, while Luori uses a search tree structure to expand the probe layer by layer. These methods cannot effectively determine the length and pattern of the full response prefix, resulting in low efficiency. If the length decision is incorrect, it will have a significant impact on the results. For example, if a prefix of / 64 is incorrectly judged as / 80, then according to existing methods, a large amount of prefix probing resources will be wasted, and it will have a significant impact on the dataset.

[0007] (2) Multi-protocol probing task: Existing work makes it difficult to extend the full response prefix probing task to all protocol activity types. Preliminary research found that the full response prefix distribution differs under different protocols, and different activity states exist. Probing can only be performed on an internet-wide scale under each protocol activity type, which is an unacceptable overhead. For example, there are 65536*2 = 131072 possible full response prefix activity types under TCP and UDP protocols. Summary of the Invention

[0008] The present invention aims to at least partially solve one of the technical problems in the related art.

[0009] Therefore, the first objective of this invention is to propose an IPv6 full response prefix detection method based on an autoregressive model.

[0010] The second objective of this invention is to propose an IPv6 full response prefix detection device based on an autoregressive model.

[0011] The third objective of this invention is to provide an electronic device.

[0012] The fourth objective of this invention is to provide a computer-readable storage medium.

[0013] The fifth objective of this invention is to provide a computer program product.

[0014] To achieve the above objectives, a first aspect of the present invention proposes an IPv6 full response prefix detection method based on an autoregressive model, comprising:

[0015] Semantic features of the target network, including routing prefix, protocol type, AS, and business relationship, are obtained. The binary representation of the full response prefix is ​​fused with the semantic features to generate an input sequence. Based on the input sequence, semantic learning is performed using an autoregressive model. The probability distribution of the full response prefix pattern is generated through a self-attention mechanism and position encoding. A Top-P sampling strategy is used to generate candidate full response prefixes.

[0016] The candidate full response prefix is ​​scanned online, probe messages are sent and response results are collected, and it is determined whether the candidate full response prefix is ​​a true full response prefix.

[0017] Granularity correction is performed on candidate prefixes that are confirmed as full response prefixes. By gradually shortening the prefix length and re-probing, a binary search strategy is used to determine its true length, thus constructing an accurate full response prefix database.

[0018] Optionally, the step of obtaining the semantic features of the target network, including routing prefix, protocol type, AS to which it belongs, and business relationship, and fusing the binary representation of the full response prefix with the semantic features to generate an input sequence, further includes:

[0019] The routing prefix is ​​converted to binary form, and a sequence start symbol is inserted at the beginning of the sequence and a sequence stop symbol is inserted at the end of the sequence to clearly define the sequence boundaries.

[0020] The routing prefix, protocol type, AS, and business relationship are mapped into high-dimensional embedding vectors through the embedding layer, and the embedding vectors are added to the location code to obtain the final input embedding vector.

[0021] Optionally, the step of performing semantic learning based on the input sequence using an autoregressive model, generating a probability distribution of the full response prefix pattern through a self-attention mechanism and positional encoding, and generating candidate full response prefixes using a Top-P sampling strategy, further includes:

[0022] Attention weights between embedding vectors are calculated using a multi-head self-attention mechanism to capture long-distance dependencies between full response prefix patterns and semantic features;

[0023] Based on the attention weights and the feature vectors output by the feedforward neural network, a joint probability distribution is calculated, and a Top-P sampling strategy is adopted to sample only the lexical units whose cumulative probability reaches a preset threshold, so as to improve the accuracy and diversity of generated candidate prefixes.

[0024] Optionally, the step of performing online scanning of the candidate full response prefix, sending probe packets and collecting response results, and determining whether the candidate full response prefix is ​​a true full response prefix further includes:

[0025] Multiple probe IP addresses are generated based on the candidate full response prefixes, and corresponding probe packets are sent for each protocol type.

[0026] Statistical analysis is performed on the response results of the probe packets. If all probe IP addresses return a consistent response within a preset time, the candidate full response prefix is ​​determined to be a true full response prefix.

[0027] Optionally, the step of performing granular correction on candidate prefixes confirmed as full response prefixes, by progressively shortening the prefix length and re-probing, and using a binary search strategy to determine its true length, thereby constructing an accurate full response prefix database, further includes:

[0028] Set the length of the full response prefix obtained from the initial probe to l, halve l in each round, and generate a new probe IP address based on the shortened prefix;

[0029] The shortened probe IP address is verified. If all addresses respond, the prefix length is shortened further; otherwise, the current length is retained as the final full response prefix length.

[0030] To achieve the above objectives, a second aspect of the present invention provides an IPv6 full response prefix detection device based on an autoregressive model, comprising:

[0031] The input sequence generation module is used to obtain the semantic features of the target network, including routing prefix, protocol type, AS, and business relationship, and to fuse the binary representation of the full response prefix with the semantic features to generate the input sequence.

[0032] The semantic learning and candidate generation module is used to perform semantic learning based on the input sequence using an autoregressive model, generate the probability distribution of the full response prefix pattern through a self-attention mechanism and positional encoding, and generate candidate full response prefixes using a Top-P sampling strategy.

[0033] The online scanning and verification module is used to perform online scanning of the candidate full response prefix, send probe messages and collect response results, and determine whether the candidate full response prefix is ​​a true full response prefix.

[0034] The granularity correction and database construction module is used to perform granularity correction on candidate prefixes that are confirmed as full response prefixes. By gradually shortening the prefix length and re-probing, a binary search strategy is used to determine its true length and construct an accurate full response prefix database.

[0035] To achieve the above objectives, a third aspect of the present invention provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor;

[0036] The memory stores computer-executed instructions;

[0037] The processor executes computer execution instructions stored in the memory to implement the method as described in any one of the first aspects.

[0038] To achieve the above objectives, a fourth aspect of the present invention provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of the first aspects.

[0039] To achieve the above objectives, a fifth aspect of the present invention provides a computer program product that, when executed by a processor, implements the method described in any one of the first aspects.

[0040] The technical solutions provided by the embodiments of the present invention bring at least the following beneficial effects:

[0041] First, this invention utilizes an autoregressive model to dynamically generate conditional probability distributions based on the characteristics of different protocols, thereby achieving joint probability modeling. It is the first to achieve unified detection and modeling of full response prefixes for multiple protocol types, including ICMPv6, TCP, and UDP, using a single algorithm, demonstrating strong scalability.

[0042] Second, this invention, through semantic learning, can capture the complex relationship between full response prefix patterns and their related factors, thereby gaining a deeper understanding of the distribution patterns and influencing factors of full response prefixes. Based on a real seed dataset, compared with MAPD and Luori, this invention achieves nearly 35 times higher detection efficiency, 4.2 times larger coverage space, and covers more autonomous systems and routing prefixes under the same budget, demonstrating excellent performance.

[0043] Third, this invention incorporates a granularity correction mechanism. This mechanism first, based on the detection results, gradually shortens the length of the full response prefix and re-detects until the correct length is found that elicits responses from all addresses. Through this method, this invention effectively avoids the "full response prefix granularity error" problem, thereby improving detection accuracy.

[0044] Fourth, it has advanced academic research in areas such as network measurement, network mapping, and network security. IPv6 full response prefix detection establishes a full response prefix list, providing data support for network measurement, network mapping, and network security.

[0045] Fifth, it supports the commercialization of IPv6 network products in the industrial network measurement and security fields. The detected full response prefix can effectively remove spoof addresses (addresses under the full response prefix) from active IPv6 addresses. The cleaned active IPv6 addresses better support the promotion of network measurement products in the next-generation Internet field, and further support security companies in expanding their IPv6 network products.

[0046] Sixth, probing full response prefixes helps in understanding the status of one's own IPv6 network, ensuring national information network security, and seizing the high ground and initiative in network security. The established full response prefix list is also a crucial foundation for service identification and location, vulnerability discovery, penetration testing, and other network attack methods.

[0047] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0048] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0049] Figure 1 This is a flowchart illustrating an IPv6 full response prefix detection method based on an autoregressive model provided in an embodiment of the present invention.

[0050] Figure 2 This is a flowchart illustrating an IPv6 full response prefix detection method based on an autoregressive model provided in an embodiment of the present invention.

[0051] Figure 3 This is a schematic diagram of the semantic learning process provided in an embodiment of the present invention;

[0052] Figure 4 This is a schematic diagram of the prefix inference process provided in an embodiment of the present invention;

[0053] Figure 5 This is a schematic diagram of the granularity correction strategy provided in an embodiment of the present invention;

[0054] Figure 6 This is a schematic diagram of the structure of an IPv6 full response prefix detection device based on an autoregressive model provided in an embodiment of the present invention; Detailed Implementation

[0055] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0056] This invention aims to propose an efficient proactive detection method for active full response prefixes across multiple protocols and ports on the entire network, and to conduct long-term detection to construct and maintain a long-term list of full response prefixes across the entire network. On the one hand, the full response prefix list can help researchers mitigate the impact of full response prefixes on their measurement activities and serve as a dataset to reduce unnecessary network burden caused by redundant measurements. On the other hand, it can also reveal the status and characteristics of a large number of full response prefixes across the entire network, which helps to explore their use cases and implementation methods, and provides in-depth insights into their practical applications.

[0057] This invention provides a method for detecting the IPv6 full response prefix based on an autoregressive model. Figure 1 and Figure 2 This is a flowchart illustrating an IPv6 full response prefix detection method based on an autoregressive model, provided in an embodiment of the present invention. Figure 1 and Figure 2 As shown, the method includes the following steps:

[0058] S1. Obtain the semantic features of the target network, including routing prefix, protocol type, AS, and business relationship. Then, fuse the binary representation of the full response prefix with the semantic features to generate an input sequence. Based on the input sequence, use an autoregressive model to perform semantic learning. Generate the probability distribution of the full response prefix pattern through a self-attention mechanism and positional encoding. Finally, use a Top-P sampling strategy to generate candidate full response prefixes.

[0059] Specifically, this step involves extracting semantic features of the target network, such as routing prefixes, protocol types, affiliated ASs, and business relationships, and fusing them with the binary representation of the full response prefix to generate a sequence for input to the autoregressive model. In some implementations, this process first obtains the routing prefix information of the target network through the BGP routing table, typically represented in IPv6 address format. Protocol types vary depending on the probe task, including ICMPv6, TCP, UDP, etc., each corresponding to a different active response mode. Affiliated AS information is extracted through BGP path attributes to identify the topology affiliation of the network operator or organization. Business relationships are marked using relationships such as Peering, Customer, and Provider in the AS path to reflect the economic or management attributes between networks.

[0060] Data analysis revealed that the full response prefix pattern is not randomly distributed but is influenced by a combination of factors, such as the activity protocol type, service type, AS (Application Server), and routing prefix. These factors exhibit complex semantic relationships, making them difficult to model using simple rules or feature engineering. Therefore, to establish a unified full response prefix prediction algorithm for multiple protocols, this invention constructs a highly scalable model. The core capability of this model lies in its ability to dynamically generate corresponding conditional probability distribution sets based on the characteristic conditions of different protocols, thereby achieving joint probabilistic modeling of full response prefix performance indicators under various experimental scenarios. Therefore, one embodiment of this invention employs a sequence model for semantic learning of the full response prefix pattern.

[0061] like Figure 3 As shown, semantic learning can effectively capture semantic information in sequence data, such as the relationships between lexical units and sequence structure, thereby helping the algorithm better understand the full response prefix pattern and generate a representation of the full response prefix pattern. This leads to more accurate predictions and improves the efficiency and accuracy of full response prefix detection. Semantic learning is a key step in understanding and predicting full response prefix patterns in the algorithm of this invention. It learns the complex relationships in the input data through self-attention mechanisms and embedding techniques, aiming to identify and avoid "full response prefix granularity errors" through cross-entropy loss optimization, thereby improving the accuracy of full response prefix detection.

[0062] Reference Figure 3 The embedding layer provides a high-dimensional information representation. Based on the above analysis, in order for the model to better learn the relationships between active protocol types, business types, affiliated ASs, and routing prefixes, one embodiment of the present invention employs a long sequence for semantic learning. For example... Figure 3 As shown, the word segmenter uses BGP to advertise routes, business relationships, and other information, mapping the target prefix to a sequence of tokens, and finally to an embedding vector. To address the variable-length nature of the full response prefix sequence, a sequence start symbol (BOS) and a sequence end symbol (EOS) are added to the sequence to indicate the beginning and end of the sequence. This means that the algorithm can flexibly learn the length information of the full response prefix, thus avoiding the "full response prefix granularity error".

[0063] To enable the model to fully utilize the learned sequence order for semantic learning, one embodiment of the present invention adds positional encoding to the embedding vector to obtain the final input embedding vector, as follows:

[0064]

[0065] IE = TE + PE

[0066] Where pos represents position, i represents dimension, and d... modelIt is the dimension of the embedded vectors in the model.

[0067] Furthermore, in the process of mapping the full response prefix to tokens, to ensure that the model can perform more fine-grained learning and prediction, in one embodiment of the present invention, the full response prefix is ​​expanded into a binary representation. The full response prefix consists of a routing prefix part and a full response prefix pattern part. During semantic learning, the model can capture long sequence dependencies based on the input sequence of the routing prefix part and learn the pattern representation of the full response prefix.

[0068] In addition, the autoregressive model has the following structure:

[0069] The final loss function optimizes the difference between the predicted probability distribution and the distribution of the true labels by calculating the cross-entropy loss.

[0070]

[0071] Where y is the actual label distribution. It is the probability distribution predicted by the model.

[0072] In this model, to ensure consistent logical order in sequence generation, all token generation relies solely on previously generated tokens. Attention scores are masked to guarantee that the model learns semantics through information such as associated protocol types and business relationships, preventing the model from seeing future information during the learning of full response prefix patterns.

[0073] In this model, the encoder consists of multiple stacked coding layers, each composed of a multi-head self-attention mechanism (MHSA), layer normalization (LN), and a feedforward neural network (FFN). The encoded embedding vector X is then compared with the matrix W. q W K W V The calculation yielded:

[0074] Q = XW Q K = XW K V = XW V

[0075] Perform matrix operations on the obtained matrices Q, K, and V, and calculate the attention weights:

[0076]

[0077] The calculation results from each head are concatenated and then subjected to a linear transformation:

[0078] MultiHead(Q,K,V)=Concat(Attention1,…,Attention h )·WO

[0079] in It is the output projection matrix.

[0080] The attention output is normalized after being added to the original input:

[0081] Z=LayerNorm(X+Dropout(MultiHead(Q,K,V)))

[0082] A feedforward neural network consists of two linear layers and nonlinear activations:

[0083] FFN(Z)=ReLU(Z·W1+b1)·W2+b2

[0084] Final output:

[0085] Output=LayerNorm(Z+Dropout(FFN(Z)))

[0086] in These are the parameters of the feedforward layer.

[0087] Finally, Z is fed into a feedforward neural network and added to the original input, and then normalized through a layer to obtain the output.

[0088] To enable the model to generate patterns of full response prefixes based on joint probabilities under multiple given conditions, this embodiment of the invention employs prefix inference. Its decision-making process can be viewed as a Markov chain; for a given known full response prefix, such as... Figure 4 As shown, the model will learn the following decision-making process:

[0089] Sampling: During prefix inference, the model will provide the probability value of predicting the next word for the existing sequence. In order to balance "development" and "exploration", this embodiment of the invention sorts these probabilities from large to small and performs cumulative probability calculation. Words that satisfy probability p are sampled according to their probability, that is, Top-P sampling is performed.

[0090]

[0091] C(w i )≥p

[0092] Therefore, the probability that the next word w is selected is:

[0093]

[0094] S2. Perform an online scan on the candidate full response prefix, send probe messages and collect response results to determine whether the candidate full response prefix is ​​a true full response prefix.

[0095] In one embodiment of the present invention, online scanning is responsible for performing detection operations based on the candidate full response prefixes generated by the prefix inference step and collecting detection results. It mainly consists of two steps: full response prefix confirmation and granularity correction.

[0096] In the full response prefix verification process, the online scanning step generates a series of IP addresses to be probed based on the candidate full response prefixes and performs probe operations on these IP addresses. Then, the online scanning step collects the probe results and determines whether the candidate full response prefix is ​​a genuine full response prefix based on the results. If all probed IP addresses under a prefix respond to the probe requests, it indicates that the candidate full response prefix is ​​a genuine full response prefix, and it is added to the full response prefix database.

[0097] S3. Perform granular correction on the candidate prefixes that are confirmed as full response prefixes. By gradually shortening the prefix length and re-probing, a binary search strategy is used to determine its true length and construct an accurate full response prefix database.

[0098] In one embodiment of the present invention, granularity correction is performed on candidate prefixes that are confirmed as full response prefixes, and the length of the full response prefix is ​​adjusted according to the detection results, thereby avoiding granularity errors that may exist in the full response prefix dataset and improving the accuracy of detection.

[0099] Current research has found that existing full response prefix datasets (such as Hitlist) suffer from numerous prefix granularity errors. For example, many / 48 and / 56 prefixes are incorrectly classified as / 64 full response prefixes. The deviation between the prefix length distribution in the dataset and the full response prefixes deployed in the real network environment affects the performance of prediction methods. For instance, the method proposed in this invention may learn incorrect sequence distributions during semantic learning, thus generating noise during prefix inference.

[0100] To address this issue, this invention employs a granularity correction mechanism. By correcting the length of existing prefixes, a full response prefix that more closely approximates the true length distribution is obtained. For example... Figure 5 As shown, the length of the full response prefix obtained from the initial probe is set to l. In each round, l is halved, and a new probe IP address is generated based on the shortened prefix. Then, the shortened probe IP address is verified. If all addresses respond, the prefix length is shortened again; otherwise, the current length is retained as the final full response prefix length.

[0101] To achieve the above embodiments, the present invention also proposes an IPv6 full response prefix detection device based on an autoregressive model. Figure 6 This is a schematic diagram of an IPv6 full response prefix detection device based on an autoregressive model, provided as an embodiment of the present invention. Figure 6 As shown, the device includes:

[0102] The input sequence generation module 100 is used to obtain the semantic features of the target network, including routing prefix, protocol type, AS, and business relationship, and to fuse the binary representation of the full response prefix with the semantic features to generate an input sequence.

[0103] The semantic learning and candidate generation module 200 is used to perform semantic learning based on the input sequence using an autoregressive model, generate the probability distribution of the full response prefix pattern through a self-attention mechanism and positional encoding, and generate candidate full response prefixes using a Top-P sampling strategy.

[0104] The online scanning and verification module 300 is used to perform online scanning on the candidate full response prefix, send probe messages and collect response results, and determine whether the candidate full response prefix is ​​a real full response prefix.

[0105] The granularity correction and database construction module 400 is used to perform granularity correction on candidate prefixes that are confirmed as full response prefixes. By gradually shortening the prefix length and re-probing, a binary search strategy is used to determine its true length and construct an accurate full response prefix database.

[0106] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0107] To implement the above embodiments, the present invention also proposes an electronic device, comprising: a processor, and a memory communicatively connected to the processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to implement the method provided in the foregoing embodiments.

[0108] To implement the above embodiments, the present invention also proposes a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the methods provided in the foregoing embodiments.

[0109] To implement the above embodiments, the present invention also proposes a computer program product, including a computer program that, when executed by a processor, implements the methods provided in the foregoing embodiments.

[0110] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in this invention all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0111] It should be noted that personal information collected from users should be used for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. Furthermore, such collection / sharing should only be conducted after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign an agreement / authorization that includes authorization of relevant user information before the user uses the function. In addition, any necessary steps must be taken to protect and safeguard access to such personal information data and ensure that others with access to personal information data comply with their privacy policies and procedures.

[0112] This invention is intended to provide implementation schemes for users to selectively prevent the use or access to personal information data. That is, this disclosure is intended to provide hardware and / or software to prevent or block access to such personal information data. Once personal information data is no longer needed, risks can be minimized by restricting data collection and deleting data. Furthermore, where applicable, such personal information can be de-identified to protect user privacy.

[0113] In the foregoing descriptions of the embodiments, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0114] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0115] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of the invention pertain.

[0116] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-including system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and programmable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0117] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any of the following techniques known in the art, or a combination thereof: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0118] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0119] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0120] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present invention.

[0121] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0122] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for detecting the IPv6 full response prefix based on an autoregressive model, characterized in that, include: The process involves: acquiring semantic features of the target network, including routing prefixes, protocol types, affiliated ASs, and business relationships; fusing the binary representation of the full response prefix with the semantic features to generate an input sequence; performing semantic learning using an autoregressive model based on the input sequence; generating a probability distribution of the full response prefix pattern through a self-attention mechanism and positional encoding; and generating candidate full response prefixes using a Top-P sampling strategy. The process includes: converting the routing prefix into binary form and inserting a sequence start symbol at the beginning of the sequence and a sequence stop symbol at the end of the sequence to define the sequence boundaries; mapping the routing prefix, protocol type, affiliated AS, and business relationship into high-dimensional embedding vectors through an embedding layer, and adding the embedding vectors to the positional encoding to obtain the final input embedding vector; calculating attention weights between the embedding vectors using a multi-head self-attention mechanism to capture the long-distance dependency between the full response prefix pattern and the semantic features; calculating the joint probability distribution based on the attention weights and the feature vector output by the feedforward neural network; and using a Top-P sampling strategy to sample only tokens with a cumulative probability reaching a preset threshold to improve the accuracy and diversity of generated candidate prefixes. The candidate full response prefix is ​​scanned online, probe messages are sent and response results are collected, and it is determined whether the candidate full response prefix is ​​a true full response prefix. Granularity correction is performed on candidate prefixes that are confirmed as full response prefixes. By gradually shortening the prefix length and re-probing, a binary search strategy is used to determine its true length, thus constructing an accurate full response prefix database.

2. The method as described in claim 1, characterized in that, The step of performing online scanning of the candidate full response prefixes, sending probe messages and collecting response results, and determining whether the candidate full response prefixes are genuine full response prefixes further includes: Multiple probe IP addresses are generated based on the candidate full response prefixes, and corresponding probe packets are sent for each protocol type. Statistical analysis is performed on the response results of the probe packets. If all probe IP addresses return a consistent response within a preset time, the candidate full response prefix is ​​determined to be a true full response prefix.

3. The method as described in claim 1, characterized in that, The step of performing granular correction on candidate prefixes confirmed as full response prefixes, by progressively shortening the prefix length and re-probing, using a binary search strategy to determine their true length, and constructing an accurate full response prefix database, also includes: Set the length of the full response prefix obtained from the initial probe to l, halve l in each round, and generate a new probe IP address based on the shortened prefix; The shortened probe IP address is verified. If all addresses respond, the prefix length is shortened further; otherwise, the current length is retained as the final full response prefix length.

4. An IPv6 full response prefix detection device based on an autoregressive model, characterized in that, include: The input sequence generation module is used to obtain the semantic features of the target network, including routing prefix, protocol type, AS, and business relationship, and to fuse the binary representation of the full response prefix with the semantic features to generate the input sequence. The input sequence generation module is further configured to convert the routing prefix into binary form, insert a sequence start at the beginning of the sequence, and insert a sequence stop at the end of the sequence to define the sequence boundaries; the routing prefix, protocol type, AS, and business relationship are mapped into high-dimensional embedding vectors through the embedding layer, and the embedding vectors are added to the position code to obtain the final input embedding vector; The semantic learning and candidate generation module is used to perform semantic learning based on the input sequence using an autoregressive model, generate the probability distribution of the full response prefix pattern through a self-attention mechanism and positional encoding, and generate candidate full response prefixes using a Top-P sampling strategy. The semantic learning and candidate generation module is also used to calculate the attention weights between the embedding vectors through a multi-head self-attention mechanism to capture the long-distance dependency between the full response prefix pattern and the semantic features; based on the attention weights and the feature vectors output by the feedforward neural network, the joint probability distribution is calculated, and a Top-P sampling strategy is adopted to sample only the lexical units whose cumulative probability reaches a preset threshold, so as to improve the accuracy and diversity of the generated candidate prefixes. The online scanning and verification module is used to perform online scanning of the candidate full response prefix, send probe messages and collect response results, and determine whether the candidate full response prefix is ​​a true full response prefix. The granularity correction and database construction module is used to perform granularity correction on candidate prefixes that are confirmed as full response prefixes. By gradually shortening the prefix length and re-probing, a binary search strategy is used to determine its true length and construct an accurate full response prefix database.

5. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-3.

6. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-3.

7. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1-3.

Images