An IPv6 network risk monitoring method and system based on a probability model and distributed self-learning

Abstract

The application discloses a kind of based on probability model and distributed self-learning's IPv6 network risk monitoring method and system, method includes: initialization to be monitored network, load IPv6 address port set and black and white list, establish distributed detection node communication channel.For each IPv6 address and port, service opening prior probability is obtained by statistics history record, combine the multi-dimensional characteristics such as response delay, TCP handshake success rate, data packet loss rate obtained by active detection, service opening conditional probability is calculated using bayesian conditional probability model and is fused to form service opening probability, write in service opening database.According to service opening probability, target is sorted, and detection is executed by each detection node under asynchronous parallel, receiving and sending decoupling mechanism and reports feedback data.Feedback is updated probability model and detection strategy by centralized collection, and detection rate and target set are adaptively adjusted, repeated detection to invalid address is reduced, and finally IPv6 network risk monitoring result is formed.

Description

Technical Field

[0001] This invention relates to the field of network security, specifically to an IPv6 network risk monitoring method based on probabilistic models and distributed self-learning. Background Technology

[0002] Network risk monitoring is a method for analyzing and identifying asset status, service accessibility, and potential vulnerabilities in large-scale network environments. It is crucial for understanding resource distribution within a network, detecting abnormal behavior patterns, and mitigating security threats. Network risk monitoring provides data support for enterprises, government agencies, and critical infrastructure operators, helping them respond promptly to risk events, optimize resource allocation, and improve network resilience. Typical applications include: identifying high-risk service ports exposed to the public internet, monitoring potential denial-of-service attack surfaces, analyzing weak passwords and configuration flaws in large-scale networks, and providing risk profiles for emergency response.

[0003] With the widespread deployment of IPv6, network risk monitoring has entered a new phase. IPv6 not only provides a massive address space but also simplifies the configuration and management of network devices, supporting automatic address allocation and end-to-end communication. While this enhances network flexibility, it also significantly increases the complexity of asset discovery and risk assessment. The sheer size of the IPv6 address space makes traditional exhaustive scanning and passive data collection ineffective, easily leading to excessive redundant probes and wasted resources. Simultaneously, the diversity and complexity of IPv6 networks place higher demands on security monitoring, requiring comprehensive coverage and accurate identification of potential risks while ensuring harmless probe detection.

[0004] IPv6 network risk monitoring is a network mapping and security detection technology targeting large-scale IPv6 address spaces. Its main purpose is to discover active services and potential risks within massive IPv6 addresses and service ports, enabling dynamic monitoring and security assessment of network assets. Existing IPv6 network risk monitoring methods primarily rely on fixed-strategy scanning and analysis frameworks, lacking adaptability to dynamic environments. For example, traditional methods often use static port lists for probing or full scans, failing to dynamically adjust strategies based on actual network feedback. This makes it difficult to achieve efficient risk identification on the vast scale of the IPv6 space. In large-scale probing, the lack of effective mechanisms to avoid duplicate and invalid probes leads to low monitoring efficiency, high probe redundancy, slow response speed, and insufficient system robustness. Therefore, how to construct efficient probabilistic models for target prediction in large-scale IPv6 address spaces and combine them with distributed self-learning mechanisms to improve strategy optimization capabilities, thereby achieving low-redundancy and high-efficiency IPv6 network risk monitoring, has become an urgent technical challenge. Summary of the Invention

[0005] The purpose of this invention is to overcome the shortcomings of the prior art and, from the perspective of large-scale IPv6 network risk monitoring, provide an IPv6 network risk monitoring method and system based on probabilistic models and distributed self-learning, so as to achieve efficient asset discovery and risk identification in the IPv6 address space.

[0006] The objective of this invention is achieved through the following technical solution:

[0007] A method for IPv6 network risk monitoring based on probabilistic models and distributed self-learning includes:

[0008] S1. Initialize the configuration of the IPv6 network to be monitored, load the network interface information, blacklist / whitelist configuration information, initial IPv6 address and port set of the local probe node, and establish a communication channel between the local probe node and other distributed probe nodes;

[0009] S2. For each IPv6 address and port combination, the prior probability of service availability for that IPv6 address is obtained by statistical analysis based on historical probe records.

[0010] By actively probing and extracting multidimensional features of IPv6 addresses, including response latency, TCP handshake success rate, and packet loss rate; and based on a conditional probability model using Bayes' theorem, calculating the service availability conditional probability of IPv6 addresses under the current combination of multidimensional features collected;

[0011] The prior probability of service opening is fused with the conditional probability of service opening to obtain the service opening probability of IPv6 address, and the service opening probability, along with the corresponding IPv6 address and port, is stored in the service opening database.

[0012] S3. Prioritize the IPv6 addresses and ports to be probed according to the service open probability, and assign the probe task to several distributed probe nodes. Each distributed probe node sends probe packets to IPv6 addresses and ports in an asynchronous parallel mechanism without blocking each other, and receives return packets in a decoupled manner of sending and receiving, and records the response status of IPv6 addresses, response delay and probe failure reasons to form probe feedback data.

[0013] S4. Summarize the feedback data from each probe, update the conditional probability model, recalculate the service open probability of the corresponding IPv6 address, generate an optimized probe strategy including target priority, node task allocation and probe rate, and distribute the optimized probe strategy to each distributed probe node so that each distributed probe node can dynamically adjust the scanning queue and sending frequency to reduce repeated probes of confirmed invalid IPv6 addresses.

[0014] S5. Aggregate, deduplicate, and store the detection results reported by each distributed detection node to form an IPv6 network risk monitoring database containing IPv6 addresses, port status, service open probability, and risk level. Determine whether to continue the iterative detection in steps S2 to S4 based on preset conditions. If yes, return to step S2; otherwise, output the final monitoring result and end the monitoring process.

[0015] Furthermore, in step S2, the fusion form of the service open probability is: P_final=α*P0+(1-α)*P1, where α is a weighting factor dynamically set according to the reliability of historical data and the quality of real-time detection data, P0 is the prior probability, and P1 is the conditional probability.

[0016] Furthermore, in step S2, a service openness determination threshold is set. When the service openness probability is greater than or equal to the determination threshold, the corresponding IPv6 address is determined to be open; otherwise, it is determined to be closed or uncertain. Several risk levels are divided according to the service openness probability range to identify the risk exposure degree of the IPv6 address.

[0017] Furthermore, in step S3, each distributed probe node decouples the sending and receiving processes of probe packets through an event-driven asynchronous sending and receiving mechanism; each distributed probe node maintains an independent sending queue and receiving event loop, and continues to send probe packets to subsequent IPv6 addresses while waiting for the response from the previous IPv6 address, thus avoiding invalid waiting caused by synchronous blocking.

[0018] Furthermore, steps S2 to S4 are executed in a periodic iterative manner. After each iteration cycle, the service open database and conditional probability model parameters are updated based on the newly collected detection feedback data, so that the monitoring method can adaptively adjust the detection strategy and risk assessment results as the IPv6 network environment changes.

[0019] This invention also provides an IPv6 network risk monitoring system based on probabilistic models and distributed self-learning, comprising:

[0020] The system initialization module is used to initialize and configure the IPv6 network to be monitored, load the network interface information, blacklist and whitelist configuration information, initial IPv6 address and port set of the local probe node, and establish a communication channel between the local probe node and other distributed probe nodes.

[0021] The probability model building module is used to obtain the prior probability of service availability for each IPv6 address and port combination based on historical probe records.

[0022] By actively probing and extracting multidimensional features of IPv6 addresses, including response latency, TCP handshake success rate, and packet loss rate; and based on a conditional probability model using Bayes' theorem, calculating the service availability conditional probability of IPv6 addresses under the current combination of multidimensional features collected;

[0023] The prior probability of service opening is fused with the conditional probability of service opening to obtain the service opening probability of IPv6 address, and the service opening probability, along with the corresponding IPv6 address and port, is stored in the service opening database.

[0024] The asynchronous parallel detection module is used to prioritize the IPv6 addresses and ports to be detected according to the service open probability, distribute the detection tasks to several distributed detection nodes, and send detection packets to IPv6 addresses and ports in an asynchronous parallel mechanism without blocking each other. It also receives return packets in a decoupled manner of sending and receiving, records the response status of IPv6 addresses, response delay and detection failure reasons, and forms detection feedback data.

[0025] The distributed self-learning module is used to summarize the feedback data from each probe, update the conditional probability model, recalculate the service open probability of the corresponding IPv6 address, generate an optimized probe strategy including target priority, node task allocation and probe rate, and distribute the optimized probe strategy to each distributed probe node, so that each distributed probe node can dynamically adjust the scanning queue and sending frequency to reduce repeated probes of confirmed invalid IPv6 addresses.

[0026] The results processing and output module is used to aggregate, deduplicate, and store the detection results reported by each distributed detection node to form an IPv6 network risk monitoring database containing IPv6 addresses, port status, service open probability, and risk level. Based on preset conditions, it determines whether to continue the iterative detection from the probability model building module to the distributed self-learning module. If so, it returns to the probability model building module; otherwise, it outputs the final monitoring results and ends the monitoring process.

[0027] Furthermore, the aforementioned monitoring system runs on any of the Linux, BSD, or Windows operating systems.

[0028] Preferably, the present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the steps of the IPv6 network risk monitoring method based on probabilistic models and distributed self-learning. The computer program runs on any one of Linux, BSD, or Windows operating systems.

[0029] Preferably, the present invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the IPv6 network risk monitoring method based on probabilistic models and distributed self-learning, wherein the computer program runs on any one of Linux, BSD or Windows operating systems.

[0030] Compared with the prior art, the beneficial effects of the technical solution of the present invention are:

[0031] 1. For IPv6 addresses and ports, prior probabilities are statistically calculated based on historical probe records. Conditional probabilities are calculated using a conditional probability model, combining real-time probe data with multi-dimensional features such as response latency, handshake success rate, and packet loss rate. Service openness probabilities are obtained through weighted fusion, forming a service openness database. By jointly modeling historical probe data and features obtained from real-time probes, the question of whether to probe and which targets to probe first is transformed into a probability prediction problem, filtering out a large number of low-probability targets and narrowing the probe scope. The service openness database is continuously accumulated and dynamically updated, allowing subsequent probes to increasingly focus on targets that are more likely to be open or have higher risks. Compared to simple static port lists or random scanning, this significantly reduces the number of invalid probes, covers more effective assets with the same resource consumption, and improves the efficiency and accuracy of risk monitoring.

[0032] 2. By integrating prior probability and conditional probability with adjustable weights, a decision threshold is set for service access determination and risk level classification. Dynamic adjustment of the weighting factors achieves a balance between historical stability and real-time sensitivity: when historical data is insufficient or the environment changes rapidly, the weight of the conditional probability component can be increased to enhance the perception of new risks; by configuring the decision threshold, it adapts to different operational and security policy requirements, ensuring that the technical solution of this invention maintains good availability and deployment flexibility under different network environments and security policies.

[0033] 3. IPv6 address probing is performed in parallel on multiple probe nodes, with each node independently scanning and recording feedback. Each probe node sends the probe results back to the distributed self-learning module via message queues or RPC. The distributed self-learning module updates the conditional probability model and service openness probability based on the feedback, regenerating strategies such as target priority, node task allocation, and probe rate. Finally, a distributed self-learning closed loop is formed through multiple iterations. By combining centralized analysis and distributed execution, horizontal scaling is achieved by utilizing multi-node resources, while global strategies avoid duplication and conflicts between nodes. The self-learning strategy proactively moves resources from ineffective areas to high-value areas, such as prioritizing address segments with high hit rates or high risks, compressing address segments that have been unresponsive for a long time, significantly reducing redundant probes, and improving monitoring speed. After multiple iterations, the probe path and resource allocation gradually approach the "optimal" or "suboptimal" strategy, thereby continuously improving effective coverage and risk identification capabilities in long-term operation.

[0034] 4. The probe nodes employ an asynchronous transmission and reception mechanism, decoupling message sending from response reception. While waiting for a response from a previous target, they continue sending probe messages to subsequent targets, enabling large-scale concurrent probing. Asynchronous parallelism and decoupling of transmission and reception allow probe nodes to operate continuously at any time, significantly increasing the number of targets detectable per unit time. For a large number of timeout or unresponsive targets, nodes are not bound to them, drastically shortening the overall scanning time. This improves the system's robustness under network jitter, packet loss, and high latency environments, making large-scale IPv6 risk monitoring engineering feasible.

[0035] 5. The detection protocols not only include TCP, UDP, and ICMP, but can also be extended to application layer protocols such as DNS, HTTP, and NTP. The detection result processing module performs unified normalization on the results returned by different protocols. Multi-protocol joint detection can discover more types of service assets, such as web services, DNS resolution services, and time synchronization services, thereby building a more complete risk profile. Through application layer protocol detection, service type, version, and other information can be further identified, providing a direct data foundation for subsequent vulnerability matching and risk assessment.

[0036] 6. The system supports operation on different operating systems such as Linux, BSD, and Windows; it supports deployment on general-purpose servers, high-performance probe nodes, and devices equipped with zero-copy or DPDK accelerated network cards. The multi-platform compatibility design lowers the deployment threshold, allowing the same methodology to be reused in different hardware and software environments, facilitating its adoption by operators, enterprises, and research institutions. In suitable environments, utilizing dedicated network cards and high-speed I / O mechanisms can further enhance probe performance, providing hardware support for scanning and risk monitoring in ultra-large-scale IPv6 spaces. Attached Figure Description

[0037] Figure 1 This is a flowchart illustrating the method of the present invention.

[0038] Figure 2 This is a schematic diagram of the system of the present invention. Detailed Implementation

[0039] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only for explaining the present invention and are not intended to limit the present invention.

[0040] Example 1

[0041] This embodiment provides an IPv6 network risk monitoring method based on probabilistic models and distributed self-learning. It analyzes the characteristics of IPv6 addresses and ports using a conditional probability model to calculate service openness probabilities and form a service openness database. Furthermore, it combines a distributed self-learning mechanism, utilizing real-time feedback from multiple probe nodes to dynamically adjust probe strategies and rates, thereby achieving high-speed, low-redundancy risk monitoring of the IPv6 space. Simultaneously, it employs an asynchronous parallel mechanism to complete data collection and processing, avoiding the ineffective waiting of traditional synchronous methods and improving overall monitoring efficiency and system robustness. Specifically, it includes:

[0042] S1. Initialize the configuration of the IPv6 network to be monitored, load the network interface information, blacklist and whitelist configuration information, initial IPv6 address and port set of the local probe node, and establish a communication channel between the local probe node and other distributed probe nodes to provide the operating environment for subsequent detection and feedback;

[0043] S2. For each IPv6 address A and port P combination, the prior probability of service availability for that IPv6 address is obtained by statistically analyzing historical probe records; for example, if k out of the past N historical probes showed that the service was available, then the prior probability P0 = k / N can be obtained.

[0044] Multidimensional features of IPv6 addresses are extracted through real-time proactive detection, including response latency, TCP handshake success rate, and packet loss rate. Based on the conditional probability model of Bayes' theorem, the conditional probability P1 of service opening of IPv6 addresses is calculated under the current combination of multidimensional features. For example, if the response latency is below the threshold and the handshake is successful, the conditional probability P1 of service opening in this case is calculated by Bayes' theorem.

[0045] The prior probability and conditional probability of service openness are fused, and a weighted model is used to calculate the final service openness probability: P_final = α·P0 + (1-α)·P1, where α is an adjustment factor that can be dynamically adjusted according to data reliability. The final service openness probability, along with the corresponding IPv6 address and port, is stored in the service openness database. The typical value of α is usually between 0.2 and 0.8: when initial data is scarce or feedback samples are noisy, α is increased to enhance the stability of the prior model; when the scale of feedback data increases, the statistical variance decreases, or the consistency between nodes improves, α is automatically decreased, giving the conditional probability a higher weight, thus reflecting the dynamic characteristics of the detection environment.

[0046] "Data reliability" mainly includes three aspects: first, the stability of the detection results (such as the consistency of multiple detection results for the same target); second, the credibility of the node source (such as the historical false alarm rate of nodes, network quality, etc.); and third, the robustness of statistics (such as sample size, sampling bias, effective response rate, etc.). By normalizing and quantifying these indicators, a comprehensive reliability score is formed, and α is adjusted accordingly to make its impact on probabilistic fusion more consistent with the changes in the actual detection environment.

[0047] Finally, a threshold-based judgment mechanism is used to determine the open probability and credibility of IPv6 address services. This method effectively reduces unnecessary probing and improves the efficiency of network service mapping and risk monitoring. Specifically, a judgment threshold θ is set; when P_final ≥ θ, the target service is determined to be open; otherwise, it is determined to be closed or uncertain. In different application scenarios, the threshold θ can be flexibly configured according to business needs. For example, a lower threshold can be selected in risk mapping to improve coverage, while a higher threshold can be selected in precise attack surface analysis to improve accuracy.

[0048] The flexibility of the threshold θ allows the method to switch between different tasks: when it is desirable to cover as many potential services as possible, a lower range of θ = 0.3 to 0.5 can be selected; while in scenarios that emphasize confirmation (such as high-value asset identification), θ can be increased to 0.7 to 0.9 to reduce false positives.

[0049] For example, given the combination of "high prefix activity + common open ports + high AS number risk" for a target IPv6 address, the model gives a prior probability P0 = 0.65, and the conditional probability P1 = 0.80 reported by the probe node. When data reliability is high, α is automatically reduced; assuming α = 0.3, the final open probability is: P_final = 0.3 × 0.65 + 0.7 × 0.80 = 0.755.

[0050] If the current scenario uses θ=0.7, the target is judged as "open and high value" and is given priority for detection; conversely, if a low-value target has P0=0.20 and P1=0.30, then under the same α, P_final=0.27 is obtained, which is lower than the judgment threshold and is automatically filtered out, thus significantly reducing unnecessary scanning.

[0051] S3. Prioritize the IPv6 addresses and ports to be probed according to the service open probability, and assign the probe task to several distributed probe nodes. Each distributed probe node sends probe packets to IPv6 addresses and ports in an asynchronous parallel mechanism without blocking each other, and receives return packets in a decoupled manner of sending and receiving, and records the response status of IPv6 addresses, response delay and probe failure reasons to form probe feedback data.

[0052] This embodiment employs an asynchronous decoupling mechanism for sending and receiving large-scale probe requests, avoiding the ineffective waiting in traditional synchronous modes. Parallel probing technology significantly improves probe speed, ensuring efficient risk monitoring in large-scale IPv6 network environments. The key to implementing the send-receive decoupling mechanism lies in maintaining independent send and receive queues: the send queue pushes probe tasks according to priority, employing a batch asynchronous packet sending mode to improve network utilization; the receive queue is based on a high-performance circular buffer or a multi-producer single-consumer structure, ensuring non-blocking writing of large-scale response packets. To maintain probe state consistency under send-receive separation, this embodiment embeds a lightweight identifier field (such as a 32-64 bit probe token or a 5-tuple-based hash tag) into each probe request. When a response packet arrives, this identifier is used to achieve request-response mapping, thereby reliably associating round-trip data packets in a stateless protocol. This mechanism ensures that nodes can stably process probe response packets and generate accurate feedback information even under high concurrency conditions.

[0053] S4. The feedback data obtained from each distributed probe node is aggregated and uploaded to the distributed self-learning module via a message queue or RPC interface. The distributed self-learning module aggregates the feedback from each probe node and updates the conditional probability model. Based on step S2, it recalculates the service open probability of the corresponding IPv6 address, generates an optimized probe strategy including target priority, node task allocation, and probe rate, and distributes the optimized probe strategy to each distributed probe node. This enables each distributed probe node to dynamically adjust the scanning queue and sending frequency, and to perform IPv6 address probes in conjunction with an asynchronous send / receive mechanism. At the same time, it avoids repeatedly probing the same target and reduces repeated probes of confirmed invalid IPv6 addresses.

[0054] This process dynamically adjusts the detection strategy and rate based on real-time feedback data from each distributed detection node. Through a self-learning mechanism, it can identify areas with insufficient detection performance and prioritize them, while reducing redundant detection of already confirmed invalid areas, thus achieving optimal allocation of overall resources.

[0055] "Invalid regions" typically refer to IPv6 address prefixes (such as / 48, / 56, or / 64) that consistently exhibit extremely low hit rates, all response timeouts, or a very high proportion of unreachable / rejected packets across multiple probe cycles. Statistically, these regions are unlikely to generate valid service information, and continued probing will only consume bandwidth and concurrency resources. Therefore, the system automatically identifies and downgrades, limits, or freezes these regions through a self-learning mechanism, thereby significantly reducing meaningless scans and improving effective probe coverage and overall throughput.

[0056] S5. Aggregate, deduplicate, and store the detection results reported by each distributed detection node to form an IPv6 network risk monitoring database (which can also be a custom file format) containing IPv6 addresses, port status, service open probability, and risk level. Then, determine whether to continue the iterative detection of steps S2 to S4 based on preset conditions. If yes, return to step S2; otherwise, output the final monitoring result and end the monitoring process.

[0057] In this embodiment, the risk level can be comprehensively determined based on the service open probability, service type sensitivity, and historical abnormal response patterns. It can usually be divided into low risk (such as P_final being less than 0.3 or only regular basic ports being open), medium risk (P_final being between 0.3 and 0.7 or unstable responses appearing), and high risk (P_final being greater than 0.7 and the port belongs to a weak password service, the management port is exposed, or suspicious behavior appears in the historical records).

[0058] Ultimately, this embodiment is able to achieve efficient discovery and risk identification of large-scale IPv6 network environments while ensuring harmless detection.

[0059] Harmless detection can be achieved by limiting the number of probes to a single IPv6 address or subnet per unit time, using randomized probe order, controlling probe packet size and rate, and avoiding excessive access to high-risk or sensitive ports. Harmlessness can be operationally divided into several levels, such as low-intensity probes (≤1 packet per second), medium-intensity probes (≤5 packets per second), and high-intensity probes (≤10 packets per second, limited to non-sensitive ports), thereby completing effective detection tasks while ensuring network stability and security.

[0060] The monitoring method described in this embodiment is applicable to rapid detection and risk identification of any large-scale IPv6 network environment, and also includes deployment and use in specific carrier network segments or virtual private network (VPN) environments.

[0061] Preferably, in the asynchronous parallel detection process of step S3, data packets of common network protocols such as TCP, UDP, and ICMP can be used for detection, or it can be extended to customized detection for application layer protocols (such as DNS, HTTP, and NTP). For example, in HTTP protocol detection, risks such as web management backends, default login pages, and weak passwords can be identified, thereby assisting in asset discovery and security assessment; in NTP or DNS protocol detection, server configuration defects, clock synchronization anomalies, or potential risks that may be used to amplify attacks can be detected, providing a reference for network protection and risk management.

[0062] Preferably, this embodiment utilizes the IPv6 protocol defined in RFC 8200. As the core version of the Internet Protocol, IPv6 has a 128-bit address length, providing a near-infinite address space and supporting end-to-end communication and various extension mechanisms. In network monitoring, IPv6 protocol packets serve as the basic data transmission unit, containing fields such as source address, destination address, flow label, and extended headers, providing rich characteristic information for asset discovery and risk identification.

[0063] Preferably, this embodiment utilizes Transmission Control Protocol (TCP) message packets defined in RFC 793 and User Datagram Protocol (UDP) message packets defined in RFC 768 for service identification. TCP messages, through a reliable connection-oriented transmission mechanism, reflect the openness and connectivity characteristics of service ports; UDP messages, through a lightweight connectionless mechanism, are suitable for efficiently detecting services with high real-time requirements. By analyzing the results returned by TCP and UDP, this invention can identify the service openness status and perform prediction optimization using a probabilistic model.

[0064] Example 2

[0065] Based on the same inventive concept, this application also provides an IPv6 network risk monitoring system based on probabilistic models and distributed self-learning, which can be used to implement the methods described in the above embodiments, as shown in the following embodiments. Since the principle of the IPv6 network risk monitoring system in solving the problem is similar to that of the IPv6 network risk monitoring method, the implementation of this device can refer to the aforementioned method implementation, and repeated details will not be elaborated further. As used below, the terms "unit" or "module" can refer to a combination of software and / or hardware that implements a predetermined function. Although the system described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0066] The embodiments of the present invention provide a specific implementation of a monitoring system capable of implementing an IPv6 network risk monitoring method, specifically including the following:

[0067] The system initialization module is used to initialize and configure the IPv6 network to be monitored, load the network interface information, blacklist and whitelist configuration information, initial IPv6 address and port set of the local probe node, and establish a communication channel between the local probe node and other distributed probe nodes.

[0068] The probability model building module is used to obtain the prior probability of service availability for each IPv6 address and port combination based on historical probe records.

[0069] By actively probing and extracting multidimensional features of IPv6 addresses, including response latency, TCP handshake success rate, and packet loss rate; and based on a conditional probability model using Bayes' theorem, calculating the service availability conditional probability of IPv6 addresses under the current combination of multidimensional features collected;

[0070] The prior probability of service opening is fused with the conditional probability of service opening to obtain the service opening probability of IPv6 address, and the service opening probability, along with the corresponding IPv6 address and port, is stored in the service opening database.

[0071] The asynchronous parallel detection module is used to prioritize the IPv6 addresses and ports to be detected according to the service open probability, distribute the detection tasks to several distributed detection nodes, and send detection packets to IPv6 addresses and ports in an asynchronous parallel mechanism without blocking each other. It also receives return packets in a decoupled manner of sending and receiving, records the response status of IPv6 addresses, response delay and detection failure reasons, and forms detection feedback data.

[0072] The distributed self-learning module is used to summarize the feedback data from each probe, update the conditional probability model, recalculate the service open probability of the corresponding IPv6 address, generate an optimized probe strategy including target priority, node task allocation and probe rate, and distribute the optimized probe strategy to each distributed probe node, so that each distributed probe node can dynamically adjust the scanning queue and sending frequency to reduce repeated probes of confirmed invalid IPv6 addresses.

[0073] The results processing and output module is used to aggregate, deduplicate, and store the detection results reported by each distributed detection node to form an IPv6 network risk monitoring database containing IPv6 addresses, port status, service open probability, and risk level. Based on preset conditions, it determines whether to continue the iterative detection from the probability model building module to the distributed self-learning module. If so, it returns to the probability model building module; otherwise, it outputs the final monitoring results and ends the monitoring process.

[0074] In this embodiment, the distributed self-learning module is typically deployed on a central control node, responsible for uniformly storing feedback data and updating the probability model. This module dynamically evaluates address range hit rate, region quality, and probe value through a periodic policy update process: for example, the centralized analysis module periodically calculates the hit rate, timeout rate, and invalid response ratio of each IPv6 prefix ( / 32, / 48, or / 64) within the current window; if the hit rate of a prefix remains below a threshold (e.g., <1%) and the invalid response ratio is high, region downgrading or freezing is triggered; conversely, for regions with continuously rising hit rates and stable feedback, their priority is increased, and more scans are allocated to nodes. Through this centralized update mechanism, the system can automatically filter high-value targets in the global IPv6 address space and achieve adaptive task allocation.

[0075] In addition, the monitoring system operates in a periodic iterative manner, updating the probability model and strategy after each round to achieve distributed self-learning iterative optimization, gradually improving the coverage, accuracy and efficiency of IPv6 network risk identification.

[0076] Preferably, the monitoring system in this embodiment supports running on multiple operating system environments, including Linux, BSD, and Windows.

[0077] Preferably, the monitoring system in this embodiment supports operation on multiple hardware platforms, including general-purpose servers, high-performance detection nodes, and dedicated network cards with zero-copy or DPDK acceleration capabilities, to further improve data processing efficiency and monitoring performance.

[0078] Preferably, embodiments of this application also provide a specific implementation of an electronic device capable of implementing all steps in the IPv6 network risk monitoring method based on probabilistic models and distributed self-learning described in the above embodiments. The electronic device specifically includes the following:

[0079] Processor, memory, communications interface, and bus;

[0080] The processor, memory, and communication interface communicate with each other via a bus; the communication interface is used to realize information transmission between server-side devices, metering devices, and user-side devices.

[0081] The processor is used to call the computer program in memory. When the processor executes the computer program, it implements all the steps in the IPv6 network risk monitoring method based on probabilistic model and distributed self-learning in the above embodiments.

[0082] Embodiments of this application also provide a computer-readable storage medium capable of implementing all steps of the IPv6 network risk monitoring method based on probabilistic models and distributed self-learning in the above embodiments. The computer-readable storage medium stores a computer program that, when executed by a processor, implements all steps of the IPv6 network risk monitoring method based on probabilistic models and distributed self-learning in the above embodiments.

[0083] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0084] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0085] This invention is not limited to the embodiments described above. The above description of specific embodiments is intended to illustrate and explain the technical solutions of this invention. The specific embodiments described above are merely illustrative and not restrictive. Without departing from the spirit and scope of the claims, those skilled in the art can make many specific modifications based on the teachings of this invention, and these modifications all fall within the scope of protection of this invention.

Claims

1. A method for monitoring IPv6 network risks based on probabilistic models and distributed self-learning, characterized in that, include: S1. Initialize the configuration of the IPv6 network to be monitored, load the network interface information, blacklist / whitelist configuration information, initial IPv6 address and port set of the local probe node, and establish a communication channel between the local probe node and other distributed probe nodes; S2. For each IPv6 address and port combination, the prior probability of service availability for that IPv6 address is obtained by statistical analysis based on historical probe records. By actively probing, multidimensional features of IPv6 addresses are extracted, including response latency, TCP handshake success rate, and packet loss rate. Based on the conditional probability model of Bayes' theorem, the service availability conditional probability of IPv6 addresses is calculated under the current collection of multidimensional feature combinations. The prior probability of service opening is fused with the conditional probability of service opening to obtain the service opening probability of IPv6 address, and the service opening probability, along with the corresponding IPv6 address and port, is stored in the service opening database. S3. Prioritize the IPv6 addresses and ports to be probed according to the service open probability, and assign the probe task to several distributed probe nodes. Each distributed probe node sends probe packets to IPv6 addresses and ports in an asynchronous parallel mechanism without blocking each other, and receives return packets in a decoupled manner of sending and receiving, and records the response status of IPv6 addresses, response delay and probe failure reasons to form probe feedback data. S4. Summarize the feedback data from each probe, update the conditional probability model, recalculate the service open probability of the corresponding IPv6 address, generate an optimized probe strategy including target priority, node task allocation and probe rate, and distribute the optimized probe strategy to each distributed probe node so that each distributed probe node can dynamically adjust the scanning queue and sending frequency to reduce repeated probes of confirmed invalid IPv6 addresses. S5. Aggregate, deduplicate, and store the detection results reported by each distributed detection node to form an IPv6 network risk monitoring database containing IPv6 addresses, port status, service open probability, and risk level. Determine whether to continue the iterative detection in steps S2 to S4 based on preset conditions. If yes, return to step S2; otherwise, output the final monitoring result and end the monitoring process.

2. The IPv6 network risk monitoring method based on probabilistic models and distributed self-learning as described in claim 1, characterized in that, In step S2, the fusion form of the service open probability is: P_final=α*P0+(1-α)*P1, where α is a weighting factor dynamically set according to the reliability of historical data and the quality of real-time detection data, P0 is the prior probability, and P1 is the conditional probability.

3. The IPv6 network risk monitoring method based on probabilistic models and distributed self-learning as described in claim 1 or 2, characterized in that, In step S2, a service openness determination threshold is set. When the service openness probability is greater than or equal to the determination threshold, the corresponding IPv6 address is determined to be open; otherwise, it is determined to be closed or uncertain. Several risk levels are divided according to the service openness probability range to identify the risk exposure degree of the IPv6 address.

4. The IPv6 network risk monitoring method based on probabilistic models and distributed self-learning according to claim 1, characterized in that, In step S3, each distributed probe node decouples the sending and receiving processes of probe packets through an event-driven asynchronous sending and receiving mechanism. Each distributed probe node maintains an independent sending queue and receiving event loop, and continues to send probe packets to subsequent IPv6 addresses while waiting for the response from the previous IPv6 address, thus avoiding invalid waiting caused by synchronous blocking.

5. The IPv6 network risk monitoring method based on probabilistic models and distributed self-learning according to claim 1, characterized in that, Steps S2 to S4 are executed in a periodic iterative manner. After each iteration, the service open database and conditional probability model parameters are updated based on the newly collected detection feedback data, so that the monitoring method can adaptively adjust the detection strategy and risk assessment results as the IPv6 network environment changes.

6. An IPv6 network risk monitoring system based on probabilistic models and distributed self-learning, based on the IPv6 network risk monitoring method according to any one of claims 1-5, characterized in that, include: The system initialization module is used to initialize and configure the IPv6 network to be monitored, load the network interface information, blacklist and whitelist configuration information, initial IPv6 address and port set of the local probe node, and establish a communication channel between the local probe node and other distributed probe nodes. The probability model building module is used to obtain the prior probability of service availability for each IPv6 address and port combination based on historical probe records. By actively probing, multidimensional features of IPv6 addresses are extracted, including response latency, TCP handshake success rate, and packet loss rate. Based on the conditional probability model of Bayes' theorem, the service availability conditional probability of IPv6 addresses is calculated under the current collection of multidimensional feature combinations. The prior probability of service opening is fused with the conditional probability of service opening to obtain the service opening probability of IPv6 address, and the service opening probability, along with the corresponding IPv6 address and port, is stored in the service opening database. The asynchronous parallel detection module is used to prioritize the IPv6 addresses and ports to be detected according to the service open probability, distribute the detection tasks to several distributed detection nodes, and send detection packets to IPv6 addresses and ports in an asynchronous parallel mechanism without blocking each other. It also receives return packets in a decoupled manner of sending and receiving, records the response status of IPv6 addresses, response delay and detection failure reasons, and forms detection feedback data. The distributed self-learning module is used to summarize the feedback data from each probe, update the conditional probability model, recalculate the service open probability of the corresponding IPv6 address, generate an optimized probe strategy including target priority, node task allocation and probe rate, and distribute the optimized probe strategy to each distributed probe node, so that each distributed probe node can dynamically adjust the scanning queue and sending frequency to reduce repeated probes of confirmed invalid IPv6 addresses. The results processing and output module is used to aggregate, deduplicate, and store the detection results reported by each distributed detection node to form an IPv6 network risk monitoring database containing IPv6 addresses, port status, service open probability, and risk level. Based on preset conditions, it determines whether to continue the iterative detection from the probability model building module to the distributed self-learning module. If so, it returns to the probability model building module; otherwise, it outputs the final monitoring results and ends the monitoring process.

7. The IPv6 network risk monitoring system based on probabilistic models and distributed self-learning as described in claim 6, characterized in that, It can run on any of the Linux, BSD, or Windows operating systems.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the IPv6 network risk monitoring method based on probabilistic models and distributed self-learning as described in any one of claims 1 to 5, wherein the computer program runs on any one of Linux, BSD, or Windows operating systems.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the IPv6 network risk monitoring method based on probabilistic models and distributed self-learning as described in any one of claims 1 to 5, wherein the computer program runs on any one of the Linux, BSD, or Windows operating systems.

Images