Seedless scene IPv6 active address discovery method based on general mode pedigree diagram

Abstract

The invention provides a seed-free scene IPv6 active address discovery method based on a general mode pedigree diagram, which comprises the following steps of: performing multi-granularity mode extraction on long-term stable active addresses in seed BGP prefixes based on a split hierarchical clustering (DHC) algorithm to obtain an initial address mode set of each seed BGP prefix; on the basis of the initial address mode set, screening a general mode capable of being migrated to a seed-free scene by adopting dual mechanisms of entropy screening and frequency screening, and constructing a general mode library; on the basis of the general mode library, capturing a hierarchical relationship and cross-granularity co-occurrence dependency between the general modes, and constructing a general mode pedigree graph GPGG; and based on the GPGG map, migrating the universal mode to the seed-free BGP prefix, and realizing efficient detection through multiple rounds of iteration to obtain an active IPv6 address set in the seed-free BGP prefix. According to the invention, the limitation of a seed-free scene can be broken through, and an active IPv6 address discovery technology with high coverage and high efficiency is realized, so that the requirements of large-scale IPv6 network measurement and security evaluation are met.

Description

Technical Field

[0001] This invention relates to the field of network measurement and IPv6 address detection technology, and in particular to a method for discovering active IPv6 addresses in seedless scenarios based on a general pattern genealogy. Background Technology

[0002] With the IPv4 address space exhausted, IPv6 has become the core protocol of the next-generation Internet, and the global IPv6 deployment rate continues to increase (as of July 2025, over 49% of users accessed Google services via IPv6). Active address probing, as a fundamental technology for large-scale network measurement, asset discovery, and security assessment, faces key challenges in IPv6 networks: the IPv6 address space is enormous (approximately 3.4 × 10⁻⁶). 38 (Number of addresses), traditional brute-force scanning would take millions of years, making it impossible to use the IPv4 brute-force scanning detection method; existing detection methods mostly rely on seed addresses (known active addresses) to learn configuration patterns or distribution characteristics, which completely fail in seedless scenarios.

[0003] Seedless scenarios are both widespread and urgent: Data from December 2024 shows that of the 224,000 IPv6 BGP prefixes announced globally, 156,000 were seedless, accounting for 69.63%, and the number of BGP prefixes continues to grow at an average annual rate of over 30%. Existing seedless scenario detection methods have two major drawbacks: First, the detection boundaries are limited. For example, Random Bytes and 6Scan only use a single, manually designed general pattern, with a coverage of only 6.55%~12.25%. AddrMiner-N's pattern extraction through graph community clustering lacks universality and is difficult to adapt to multiple types of BGP prefixes. Second, the detection efficiency is low. AddrMiner-N relies on WHOIS information to match similar migration patterns with seeded prefixes, randomly selecting a pattern when a match fails, resulting in a low effective matching rate and significant waste of detection resources. Summary of the Invention

[0004] The present invention aims to at least partially solve one of the technical problems in the related art.

[0005] Therefore, the first objective of this invention is to propose a method for discovering active IPv6 addresses in seedless scenarios based on a general pattern genealogy diagram.

[0006] The second objective of this invention is to propose a seedless IPv6 active address discovery device based on a universal pattern genealogy diagram.

[0007] The third objective of this invention is to provide an electronic device.

[0008] The fourth objective of this invention is to provide a computer-readable storage medium.

[0009] The fifth objective of this invention is to provide a computer program product.

[0010] To achieve the above objectives, a first aspect of the present invention proposes a method for discovering active IPv6 addresses in seedless scenarios based on a universal pattern genealogy graph, comprising: Step 1: Based on the split hierarchical clustering (DHC) algorithm, perform multi-granularity pattern extraction on long-term stable and active addresses in seeded BGP prefixes to obtain the initial address pattern set for each seeded BGP prefix. Step 2: Based on the initial address pattern set, a dual mechanism of entropy filtering and frequency filtering is used to filter general patterns that can be transferred to seedless scenarios, and a general pattern library is built. Step 3: Based on the general pattern library, capture the hierarchical relationships and cross-granularity co-occurrence dependencies between general patterns, and construct the general pattern genealogy graph GPGG; Step 4: Based on the GPGG map, migrate the general mode to the seedless BGP prefix, and achieve efficient detection through multiple rounds of iteration to obtain the set of active IPv6 addresses in the seedless BGP prefix.

[0011] Optionally, the termination condition of the traditional DHC algorithm is modified, abandoning the rule that partitioning stops when the number of node seeds is below a threshold, so that partitioning continues until the variable dimension of each node reaches the preset granularity, supporting granularity levels 1 to 5. The modified DHC algorithm is executed independently within each seeded BGP prefix to obtain the initial address pattern set of each seeded BGP prefix at granularity levels 1 to 5.

[0012] Optionally, pattern complexity can be measured by pattern entropy, with the entropy value set to a range of 0 to 1; For patterns that meet the entropy value criteria, their frequency of occurrence in different seeded BGP prefixes is counted; sorted in descending order of frequency, Top-k patterns are selected for granularity levels 1 to 5 respectively, and a general pattern library containing general patterns for granularity levels 1 to 5 is constructed.

[0013] Optionally, common patterns associated with the same granularity can be organized into families, each family can be set as a hierarchical tree, the root node can be the coarsest granular pattern in the family, the leaf nodes can be the finest granular patterns, and the parent and child nodes can be defined as coarsest patterns. Fine granular patterns are obtained by replacing wildcards with specific hexadecimal characters in one half-byte position. Directed edges are constructed between patterns from different families, with the edge weight being the conditional probability of the target pattern occurring when the source pattern exists. This generates a GPGG graph that includes the family hierarchy and cross-family conditional probability edges.

[0014] Optionally, step 41: For each seedless BGP prefix, generate a small number of addresses corresponding to the low byte in the general mode in the initial round, generate 3 to 5 addresses for each mode, calculate the temporary reward of the mode, sort them in descending order of family reward, and obtain the family priority queue. Step 42: Based on the preset budget ratio p, the optimal value is 0.5. Calculate the pre-scan budget, select families with rewards greater than 0 in the priority queue, and calculate the minimum probe amount n for each node in the family according to the principle of ensuring a 90% probability of detecting at least one active address. Step 43: For each family, select the node with the highest temporary hit rate in the pre-scan, generate all target addresses corresponding to the node pattern, perform a full scan and record the scanned patterns to remove duplicates; Step 44: Based on the pattern inclusion relationship within the family, update the rewards of all nodes in the subtree rooted at the fully scanned node; update the rewards of other complementary nodes within the family; based on the conditional probability edges of GPGG, update the reward of the target node in descending order of the source node's reward increment. Step 45: Repeat steps 42-44 until the probe budget is exhausted or the preset number of iterations is reached, and output the set of active IPv6 addresses in the seedless BGP prefix.

[0015] To achieve the above objectives, a second aspect of the present invention provides a seedless IPv6 active address discovery device based on a universal pattern genealogy graph, comprising: The pattern extraction module is used to extract long-term stable and active addresses from seeded BGP prefixes using the split hierarchical clustering (DHC) algorithm, and obtain the initial address pattern set for each seeded BGP prefix. The filtering module is used to filter general patterns that can be transferred to seedless scenarios based on the initial address pattern set, using both entropy and frequency filtering mechanisms, and to build a general pattern library. The building module is used to capture the hierarchical relationships and cross-granularity co-occurrence dependencies between general patterns based on the general pattern library, and to construct the general pattern genealogy graph GPGG. The detection module is used to migrate the general mode to the seedless BGP prefix based on the GPGG map, and achieve efficient detection through multiple rounds of iteration to obtain the set of active IPv6 addresses in the seedless BGP prefix.

[0016] To achieve the above objectives, a third aspect of the present invention provides an electronic device, comprising: a processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of the first aspects.

[0017] To achieve the above objectives, a fourth aspect of the present invention provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of the first aspects.

[0018] To achieve the above objectives, a fifth aspect of the present invention provides a computer program product that, when executed by a processor, implements the method described in any one of the first aspects.

[0019] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0020] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 This is a flowchart illustrating a seedless IPv6 active address discovery method based on a general pattern genealogy diagram, provided in an embodiment of the present invention. Figure 2 This is a schematic diagram of the framework of a seedless IPv6 active address discovery method based on a general pattern genealogy diagram provided in an embodiment of the present invention. Figure 3 This diagram illustrates a comparison between a seedless IPv6 active address discovery method based on a general pattern genealogy diagram provided in this invention and other methods. Figure 4 This is the seedless scene dataset provided in the embodiments of the present invention; Figure 5 This is a schematic diagram of the structure of a seedless IPv6 active address discovery device based on a general pattern genealogy diagram, provided in an embodiment of the present invention. Detailed Implementation

[0021] Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0022] To address the issues of "narrow coverage and low detection efficiency" in seedless IPv6 address discovery, this invention provides an active IPv6 address discovery system and method for seedless scenarios. Figure 1 This is a flowchart illustrating a seedless IPv6 active address discovery method based on a general pattern genealogy graph, provided as an embodiment of the present invention. Figure 1 , Figure 2 As shown, the method includes the following steps: Step 1: Based on the split hierarchical clustering (DHC) algorithm, perform multi-granularity pattern extraction on long-term stable and active addresses in seeded BGP prefixes to obtain the initial address pattern set for each seeded BGP prefix.

[0023] In order to obtain the initial address pattern set of each seeded BGP prefix, the embodiments of this application modify the traditional DHC algorithm and execute the modified DHC algorithm independently within each seeded BGP prefix to obtain the initial address pattern set of each seeded BGP prefix at a granularity of 1 to 5 levels.

[0024] In this embodiment of the application, in order to solve the problem that the traditional DHC algorithm may stop partitioning too early and fail to achieve the goal of fine analysis because the number of node seeds is lower than the threshold during the partitioning process, the termination condition of the traditional DHC algorithm is modified.

[0025] The optimized termination condition uses the level of granularity of the node variable dimensions as the sole basis for stopping. Specifically, the partitioning process will continue to iterate until the variable dimensions of each node precisely match the preset granularity requirements. Here, granularity refers to the specific number of wildcards in the pattern, with each level of granularity corresponding to a fixed number of wildcards, directly determining the precision of the variable dimension subdivision.

[0026] In one embodiment of the present invention, performance and effectiveness verification based on real-world application scenarios revealed that when the granularity level is set to level 6 or 7, the algorithm's hit rate drops sharply to near zero, failing to provide effective data support for subsequent analysis and thus lacking practical application value. Therefore, the algorithm in this embodiment only supports granularity settings from level 1 to level 5, ensuring a balance between partitioning accuracy and practical utility.

[0027] Next, prefix extraction is performed independently. That is, for each marked seeded BGP prefix, it is treated as an independent analysis unit, and the optimized DHC algorithm described above is fully executed within it. Since IPv6 address allocation schemes are usually configured at the BGP prefix or more specific subnet level, this ensures that the extraction mode is compatible with the address configuration scenario.

[0028] Through independent computation within each seeded BGP prefix, combined with effective granularity levels 1 to 5, this invention ultimately generates a set of initial address patterns corresponding to each seeded BGP prefix at different granularities.

[0029] In this embodiment, the final set of initial address patterns, each with a seed BGP prefix, is obtained. This not only ensures that the extracted patterns are compatible with the address configuration scenario, but also provides direct basic data for the subsequent construction of a general pattern library, laying a solid foundation.

[0030] Step 2: Based on the initial address pattern set, a dual mechanism of entropy filtering and frequency filtering is used to filter general patterns that can be transferred to seedless scenarios, and a general pattern library is built.

[0031] To construct a universal pattern library, this embodiment of the invention uses a dual mechanism of entropy filtering and frequency filtering based on the obtained initial address pattern set with seeded BGP prefixes to select universal patterns that can be migrated to seedless scenarios, thereby realizing the construction of a universal pattern library.

[0032] In this embodiment, entropy value screening is performed first, using pattern entropy to measure pattern complexity, thus establishing a basic screening standard for subsequent pattern optimization and application. The entropy value range is set to 0~1, with low-entropy patterns representing simple structures and strong versatility.

[0033] The formula for calculating pattern entropy is defined as follows:

[0034] Where P(i) is the probability of the occurrence of the non-wildcard character i.

[0035] After completing the entropy value screening and retaining patterns with reasonable structure and acceptable complexity, the embodiments of the present invention then perform frequency screening. By quantifying the cross-scenario occurrence frequency of the patterns, address patterns with universal applicability are further screened out.

[0036] Specifically, for each pattern that passes the entropy value test, this embodiment of the invention will count the number of times it appears in different seeded BGP prefixes, that is, the number of independent BGP prefixes that the pattern can match. At the same time, a hard screening condition is set, that is, the pattern must appear in at least 2 or more BGP prefixes.

[0037] After frequency statistics and filtering, the remaining patterns are sorted from highest to lowest frequency in this embodiment of the invention. For different granularities of 1 to 5, the top-k patterns are selected. Finally, a general pattern library containing common patterns for granularities of 1 to 5 is constructed.

[0038] Through the above steps, entropy and frequency filtering were completed, and a general pattern library was constructed, laying the foundation for the subsequent construction of the general pattern genealogy diagram GPGG.

[0039] Step 3: Based on the general pattern library, capture the hierarchical relationships and cross-granularity co-occurrence dependencies between general patterns, and construct the general pattern genealogy graph GPGG.

[0040] To construct a general pattern genealogy graph (GPGG), this embodiment of the invention is based on a general pattern library containing general patterns of granularity from 1 to 5 levels. By capturing the hierarchical relationships and cross-granularity co-occurrence dependencies between general patterns, a GPGG graph containing family hierarchical structure and cross-family conditional probability edges is generated.

[0041] Specifically, common patterns associated with the same granularity are organized into families, and each family is a hierarchical tree. The root node is the coarsest granular pattern in the family, and the leaf nodes are the finest granular patterns. Parent and child nodes are defined as coarse-grained patterns, which are obtained by replacing wildcards with specific hexadecimal characters (0~f) in one half-byte position to construct family relationships.

[0042] For example, the parent pattern "021:0**" (4-level granularity) is transformed into the child pattern "021:00*" (3-level granularity) by replacing the wildcard in the 5th half-byte with "0".

[0043] Next, directed edges are constructed between patterns of different families, with the edge weight being the conditional probability of the target pattern appearing when the source pattern exists. Conditional probability edges are constructed, and finally, a GPGG graph containing family hierarchy structure and cross-family conditional probability edges is generated.

[0044] In this embodiment, the general pattern genealogy graph GPGG, constructed by capturing the hierarchical relationship between general patterns and cross-granularity co-occurrence dependencies, lays the foundation for obtaining the set of active IPv6 addresses in seedless BGP prefixes.

[0045] Step 4: Based on the GPGG map, migrate the general mode to the seedless BGP prefix, and achieve efficient detection through multiple rounds of iteration to obtain the set of active IPv6 addresses in the seedless BGP prefix.

[0046] In order to obtain the set of active IPv6 addresses in seedless BGP prefixes, this application embodiment is based on the GPGG map, migrates the general mode to seedless BGP prefixes, and achieves efficient detection through multiple rounds of iteration to obtain the set of IPv6 addresses.

[0047] Specifically, this step is achieved through the following process: Step 41: Based on the GPGG graph, firstly, for each seedless BGP prefix, generate a small number of addresses corresponding to the low byte (e.g., 0, 1, 2) in the initial rounds of the general pattern. Generate 3-5 addresses for each pattern, calculate the temporary reward for the pattern, and sort them in descending order according to the family reward (i.e., the highest reward of nodes within the family) to obtain the family priority queue. The reward is calculated as: reward = number of discovered active addresses / pattern space size.

[0048] Step 42: Then, calculate the pre-scan budget based on the preset budget ratio p, select families with rewards greater than 0 in the priority queue, and calculate the minimum probe count n for each node's pattern within the family, based on the principle of ensuring a 90% probability of detecting at least one active address. The optimal value of p is 0.5.

[0049] Step 43: Next, for each family, select the node with the highest temporary hit rate in the pre-scan, generate all target addresses corresponding to the node pattern, and perform a full scan, that is, send probe packets based on the ICMPv6 protocol, and if a response is received, it is determined to be an active address, and the scanned patterns are recorded for deduplication.

[0050] Step 44: Update the mode and clan rewards in three steps: Subtree Update: Based on the family pattern inclusion relationship, update the reward of all nodes in the subtree rooted at the full scan node.

[0051] Complementary Update: Updates the rewards for other complementary nodes within the family.

[0052] Conditional probability update: Based on the conditional probability edges of GPGG, update the target node reward in descending order of the source node reward increment.

[0053] Step 45: Finally, repeat steps 42-44 until the probe budget is exhausted or the preset number of iterations is reached, and output the set of active IPv6 addresses in the seedless BGP prefix.

[0054] Through the above steps, the set of active IPv6 addresses in the seedless BGP prefix was successfully obtained, achieving accurate and efficient large-scale IPv6 active address detection.

[0055] Based on experimental results, the seedless IPv6 active address discovery method based on a universal pattern genealogy graph proposed in this invention has the following technical effects: (1) Wide coverage: By using general pattern filtering and GPGG modeling, it overcomes the limitation of the lack of general patterns in seedless scenarios, achieving wide coverage. For example... Figure 3 The detection coverage in seedless BGP prefixes reached 29.33%~31.83%, which is 11%~46% higher than the existing best method (AddrMiner-N), and the coverage in BGP prefixes that once contained seeds but no longer have active addresses reached 49.81%~52.51%. (2) High detection efficiency: The heuristic dynamic migration detection strategy, combined with pre-scan deduplication and reward update, improves the speed of large-scale detection by 9.76 times compared with the existing best method, and the hit rate reaches 1.32%~2.34%, which is 323%~631% higher than the existing method. It significantly reduces the consumption of detection resources (bandwidth, computing power) and improves detection efficiency. (3) Wide applicability: Continuous probing of all seedless BGP prefixes yields results such as... Figure 4 It has discovered 1.85 billion active IPv6 addresses in 46,156 seedless BGP prefixes, expanding the boundaries of known active IPv6 addresses. It has a wide range of applications and provides key technical support for large-scale IPv6 network measurement, asset discovery, and security assessment.

[0056] To achieve the above embodiments, the present invention also proposes a seedless IPv6 active address discovery device based on a general pattern genealogy diagram. Figure 5 This is a schematic diagram of a seedless IPv6 active address discovery device based on a general pattern genealogy diagram, provided as an embodiment of the present invention. Figure 5 As shown, the device includes: The pattern extraction module 100 is used to extract long-term stable and active addresses from seeded BGP prefixes using the split hierarchical clustering (DHC) algorithm, and obtain an initial address pattern set for each seeded BGP prefix. The filtering module 200 is used to filter general patterns that can be transferred to seedless scenarios based on the initial address pattern set, using a dual mechanism of entropy filtering and frequency filtering, and to build a general pattern library. Module 300 is used to capture the hierarchical relationships and cross-granularity co-occurrence dependencies between general patterns based on the general pattern library, and to construct the general pattern genealogy graph GPGG. The detection module 400 is used to migrate the general mode to the seedless BGP prefix based on the GPGG map, and achieve efficient detection through multiple rounds of iteration to obtain the set of active IPv6 addresses in the seedless BGP prefix.

[0057] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0058] To implement the above embodiments, the present invention also proposes an electronic device, comprising: a processor, and a memory communicatively connected to the processor; the memory stores computer execution instructions; the processor executes the computer execution instructions stored in the memory to implement the method provided in the foregoing embodiments.

[0059] To implement the above embodiments, the present invention also proposes a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the methods provided in the foregoing embodiments.

[0060] To implement the above embodiments, the present invention also proposes a computer program product, including a computer program that, when executed by a processor, implements the methods provided in the foregoing embodiments.

[0061] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in this invention all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0062] It should be noted that personal information collected from users should be used for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. Furthermore, such collection / sharing should only be conducted after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign an agreement / authorization that includes authorization of relevant user information before the user uses the function. In addition, any necessary steps must be taken to protect and safeguard access to such personal information data and ensure that others with access to personal information data comply with their privacy policies and procedures.

[0063] This invention is intended to provide implementation schemes for users to selectively prevent the use or access to personal information data. That is, this disclosure is intended to provide hardware and / or software to prevent or block access to such personal information data. Once personal information data is no longer needed, risks can be minimized by restricting data collection and deleting data. Furthermore, where applicable, such personal information can be de-identified to protect user privacy.

[0064] In the foregoing descriptions of the embodiments, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0065] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

[0066] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing custom logic functions or processes, and the scope of preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as should be understood by those skilled in the art to which embodiments of the invention pertain.

[0067] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device. More specific examples (a non-exhaustive list) of computer-readable media include: an electrical connection having one or more wires (electronic device), a portable computer disk drive (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Alternatively, the computer-readable medium may be paper or other suitable media on which the program can be printed, since the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in a computer memory.

[0068] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware as in another embodiment, it can be implemented using any of the following techniques known in the art, or a combination thereof: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0069] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, the program includes one or a combination of the steps of the method embodiments.

[0070] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.

[0071] The storage medium mentioned above can be a read-only memory, a disk, or an optical disk, etc. Although embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions, and variations to the above embodiments within the scope of the present invention.

[0072] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0073] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for discovering active IPv6 addresses in seedless scenarios based on a universal pattern genealogy graph, characterized in that, include: Step 1: Based on the split hierarchical clustering (DHC) algorithm, perform multi-granularity pattern extraction on long-term stable and active addresses in seeded BGP prefixes to obtain the initial address pattern set for each seeded BGP prefix. Step 2: Based on the initial address pattern set, a dual mechanism of entropy filtering and frequency filtering is used to filter general patterns that can be transferred to seedless scenarios, and a general pattern library is built. Step 3: Based on the general pattern library, capture the hierarchical relationships and cross-granularity co-occurrence dependencies between general patterns, and construct the general pattern genealogy graph GPGG; Step 4: Based on the GPGG map, migrate the general mode to the seedless BGP prefix, and achieve efficient detection through multiple rounds of iteration to obtain the set of active IPv6 addresses in the seedless BGP prefix.

2. The method as described in claim 1, characterized in that, The DHC algorithm based on split hierarchical clustering extracts multi-granularity patterns from long-term stable and active addresses in seeded BGP prefixes to obtain an initial address pattern set for each seeded BGP prefix, and also includes: The termination condition of the traditional DHC algorithm has been modified, and the rule of stopping partitioning when the number of node seeds is lower than the threshold has been abandoned. This allows partitioning to continue until the variable dimension of each node reaches the preset granularity, supporting granularity levels 1 to 5. The modified DHC algorithm is executed independently within each seeded BGP prefix to obtain the initial address pattern set of each seeded BGP prefix at granularity levels 1 to 5.

3. The method as described in claim 2, characterized in that, The initial address pattern set, employing both entropy and frequency filtering mechanisms, filters general patterns that can be transferred to seedless scenarios, constructing a general pattern library, and also includes: Pattern complexity is measured by pattern entropy, with the entropy value set to a range of 0 to 1. For patterns that meet the entropy value criteria, their frequency of occurrence in different seeded BGP prefixes is counted; sorted in descending order of frequency, Top-k patterns are selected for granularity levels 1 to 5 respectively, and a general pattern library containing general patterns for granularity levels 1 to 5 is constructed.

4. The method as described in claim 3, characterized in that, The method of capturing hierarchical relationships and cross-granularity co-occurrence dependencies among general patterns based on a general pattern library, and constructing a general pattern genealogy graph GPGG, also includes: Organize common patterns associated with the same granularity into families, set each family as a hierarchical tree, the root node is the coarsest granular pattern in the family, the leaf nodes are the finest granular patterns, and the parent and child nodes are defined as coarsest patterns. Fine granular patterns are obtained by replacing wildcards with specific hexadecimal characters in one half-byte position. Directed edges are constructed between patterns from different families, with the edge weight being the conditional probability of the target pattern occurring when the source pattern exists. This generates a GPGG graph that includes the family hierarchy and cross-family conditional probability edges.

5. The method as described in claim 4, characterized in that, The method of migrating the general pattern to seedless BGP prefixes based on GPGG maps and achieving efficient detection through multiple iterations to obtain the set of active IPv6 addresses in seedless BGP prefixes also includes: Step 41: For each seedless BGP prefix, generate a small number of addresses corresponding to the low byte in the general mode in the initial round. Generate 3 to 5 addresses for each mode, calculate the temporary reward for the mode, sort them in descending order of family reward, and obtain the family priority queue. Step 42: Based on the preset budget ratio p, the optimal value is 0.

5. Calculate the pre-scan budget, select families with rewards greater than 0 in the priority queue, and calculate the minimum probe amount n for each node in the family according to the principle of ensuring a 90% probability of detecting at least one active address. Step 43: For each family, select the node with the highest temporary hit rate in the pre-scan, generate all target addresses corresponding to the node pattern, perform a full scan and record the scanned patterns to remove duplicates; Step 44: Based on the pattern inclusion relationship within the family, update the rewards of all nodes in the subtree rooted at the fully scanned node; update the rewards of other complementary nodes within the family; based on the conditional probability edges of GPGG, update the reward of the target node in descending order of the source node's reward increment. Step 45: Repeat steps 42-44 until the probe budget is exhausted or the preset number of iterations is reached, and output the set of active IPv6 addresses in the seedless BGP prefix.

6. A seedless IPv6 active address discovery device based on a universal pattern genealogy graph, characterized in that, include: The pattern extraction module is used to extract long-term stable and active addresses from seeded BGP prefixes using the split hierarchical clustering (DHC) algorithm, and obtain the initial address pattern set for each seeded BGP prefix. The filtering module is used to filter general patterns that can be transferred to seedless scenarios based on the initial address pattern set, using both entropy and frequency filtering mechanisms, and to build a general pattern library. The building module is used to capture the hierarchical relationships and cross-granularity co-occurrence dependencies between general patterns based on the general pattern library, and to construct the general pattern genealogy graph GPGG. The detection module is used to migrate the general mode to the seedless BGP prefix based on the GPGG map, and achieve efficient detection through multiple rounds of iteration to obtain the set of active IPv6 addresses in the seedless BGP prefix.

7. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-5.

9. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1-5.

Images