Ipv6 application service address identification method and apparatus, device, and medium

Abstract

The present application discloses an IPv6 application service address identification method and apparatus, a device, and a medium. The method comprises: acquiring associated information of IPv6 addresses, wherein the associated information of the IPv6 addresses comprises at least one of the following: a domain name resolution log of a DNS, semantic information corresponding to a plurality of ASs in an RIR, and a plurality of IPv6 active addresses; acquiring the total number of a plurality of routing prefixes included in each AS among the plurality of ASs; on the basis of the associated information of the IPv6 addresses, determining a first mapping table corresponding to the associated information of the IPv6 addresses, wherein the first mapping table comprises a correspondence among IPv6 application service addresses among a plurality of reference IPv6 addresses in the associated information of the IPv6 addresses, the routing prefixes, and the ASs; and for each AS, if the ratio of the number of the routing prefixes corresponding to the AS in the first mapping table to the total number of the plurality of routing prefixes included in the AS is greater than a preset ratio threshold, determining that all the IPv6 addresses included in the AS are application service addresses.

Description

Method, device, equipment and medium for identifying IPv6 application service addresses

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to the Chinese patent application filed with the China Patent Office on October 20, 2023, with application number 202311368147.1 and application name “Method, device, equipment and medium for identifying IPv6 application service addresses”, the entire contents of which are incorporated by reference into this application. Technical Field

[0003] The present application relates to the field of computer network technology, and in particular to a method, apparatus, device and medium for identifying an IPv6 application service address. Background Art

[0004] With the rise of 5G (fifth generation), cloud computing, the Internet of Things (IoT), and the Industrial Internet, IPv4 (Internet Protocol Version 4), with its limited 32-bit address space, is unable to meet the demands of the internet's continued growth. IPv6 (Internet Protocol Version 6), with its ample 128-bit address space and the ability to provide greater communication efficiency and security, is the only means for the internet's continued growth and the foundation for the development of the next generation internet.

[0005] From the perspective of address usage, IPv6 addresses can be divided into IPv6 client addresses, IPv6 transmission device addresses, and IPv6 application service addresses. IPv6 client addresses are primarily used to identify user-side devices, including daily hosts, mobile phones, tablets, and some IoT devices. They are the initiating addresses of network traffic transmission. IPv6 transmission device addresses, including those of routers, switches, firewalls, and other devices, are intermediate device addresses for network traffic transmission. IPv6 application service addresses primarily include the addresses of website servers, backend interface program servers, and middleware servers. They are the terminating addresses of network traffic transmission.

[0006] The detection and identification of IPv6 application service type addresses can be used to distinguish between computer room traffic and non-computer room traffic, and can provide data support for network security attack and defense.

[0007] Existing methods for identifying application service types of IP (Internet Protocol) addresses are mainly oriented towards IPv4 addresses, and are classified through scanning detection, website mapping, and semantic analysis. However, due to the huge IPv6 address space, traditional scanning-based methods are no longer suitable for classifying IPv6 address application service types.

[0008] Therefore, there is an urgent need to provide a method to identify IPv6 application service type addresses to provide data support for distinguishing malicious network traffic and network security attack and defense.

[0009] Summary of the Invention

[0010] The embodiments of the present application provide a method, apparatus, device, and medium for identifying IPv6 application service addresses, which identify IPv6 application service type addresses and provide data support for distinguishing malicious network traffic and network security attacks and defenses.

[0011] In a first aspect, an embodiment of the present application provides a method for identifying an IPv6 application service address, the method comprising:

[0012] Obtaining information associated with an IPv6 address; the information associated with the IPv6 address comprising at least one of the following: a domain name resolution log of a DNS (Domain Name Service), semantic information corresponding to multiple autonomous systems (ASs) in an RIR (Regional Internet Registry), and multiple active IPv6 addresses;

[0013] Obtain a total number of routing prefixes included in each of the multiple ASs;

[0014] Determine, based on the association information of the IPv6 address, a first mapping table corresponding to the association information of the IPv6 address; wherein the first mapping table includes a correspondence between the IPv6 application service address, the routing prefix, and the AS in the plurality of reference IPv6 addresses in the association information of the IPv6 address;

[0015] For each AS in the multiple ASs: if the ratio between the number of routing prefixes corresponding to the AS in the first mapping table and the total number of multiple routing prefixes included in the AS is greater than a preset ratio threshold, it is determined that all IPv6 addresses included in the AS are application service addresses.

[0016] Therefore, by performing data analysis and distributed measurement on domain name resolution logs, analyzing the semantic information corresponding to AS, and the association between IPv4 and IPv6, it is determined whether the IPv6 address included in AS is an application service address, effectively expanding the attribute dimension of IPv6 addresses. By utilizing the semantic information of AS and the symbiotic relationship between IPv6 and IPv4, the number of identified IPv6 application service addresses is increased through analysis and inference, providing data support for distinguishing malicious network traffic and network security attack and defense.

[0017] In some embodiments, the associated information of the IPv6 address is a domain name resolution log of the DNS;

[0018] The determining, based on the association information of the IPv6 address, a first mapping table corresponding to the association information of the IPv6 address includes:

[0019] Perform domain name resolution based on the DNS domain name resolution log to obtain a correspondence between multiple reference IPv6 addresses and domain names included in the DNS domain name resolution log;

[0020] In the routing table corresponding to the domain name, query the routing prefix, AS, and IPv6 address interface type of each of the multiple reference IPv6 addresses;

[0021] Perform port detection on each of the multiple target IPv6 addresses whose IPv6 address interface type is a preset type, and determine detection results corresponding to the multiple target IPv6 addresses; the multiple target IPv6 addresses are part or all of the multiple reference IPv6 addresses;

[0022] Based on the detection result, determining an IPv6 application service address among the multiple target IPv6 addresses;

[0023] A first mapping table is obtained based on the routing prefix and AS corresponding to the IPv6 application service address.

[0024] Therefore, by performing domain name resolution on the DNS domain name resolution log, the routing prefix, AS, and IPv6 address interface class of multiple reference IPv6 addresses are obtained, and then port detection is performed on multiple target IPv6 addresses with a preset IPv6 address interface type, so that the IPv6 application service address in the multiple target IPv6 addresses can be determined, so as to provide effective reference data for judging whether the IPv6 address included in the AS is an application service address, increase the accuracy of the judgment, increase the number of identified IPv6 application service addresses, and provide data support for distinguishing network malicious traffic and network security attack and defense.

[0025] In some embodiments, determining the IPv6 application service address among the multiple target IPv6 addresses based on the detection result includes:

[0026] For each target IPv6 address in the multiple target IPv6 addresses:

[0027] If the detection result of the target IPv6 address has a return value, it is determined that the target IPv6 address is an application service address.

[0028] Therefore, whether the detection result of the target IPv6 address has a return value can be used to determine whether the target IPv6 address among the multiple target IPv6 addresses is an IPv6 application service address.

[0029] In some embodiments, the association information of the IPv6 address is the domain name resolution log of the DNS and the semantic information corresponding to the multiple ASs in the RIR; the semantic information includes identification field information and description information of the AS;

[0030] The determining, based on the association information of the IPv6 address, a first mapping table corresponding to a plurality of reference IPv6 addresses included in the association information of the IPv6 address comprises:

[0031] Based on the DNS domain name resolution log, obtaining a second mapping table of multiple reference IPv6 addresses included in the DNS domain name resolution log; the second mapping table includes a correspondence between the IPv6 application service address, the routing prefix, and the AS in the multiple reference IPv6 addresses;

[0032] For each AS among the multiple ASs: if the identification field information of the AS includes preset keywords, the AS is determined to be a reference application service AS; the preset keywords include IDC (Internet Data Center), Cloud (cloud / cloud computing platform), and CDN (Content Delivery Network);

[0033] The first mapping table is obtained based on the correspondences among the multiple reference application service ASs, the IPv6 application service addresses in the multiple reference IPv6 addresses, and the routing prefixes included in the second mapping table.

[0034] Therefore, by analyzing the semantic information corresponding to the AS, the reference application service AS is first determined, and then according to the DNS domain name resolution log, port detection is performed on multiple target IPv6 addresses whose IPv6 address interface type is a preset type in the reference application service AS, so that the IPv6 application service address among the multiple target IPv6 addresses in the reference application service AS can be determined. The AS is first screened, and then the IPv6 address is further judged, which improves the efficiency of determining whether the IPv6 address included in the AS is an application service address, increases the number of identified IPv6 application service addresses, and provides data support for distinguishing network malicious traffic and network security attack and defense.

[0035] In some embodiments, obtaining, based on the DNS domain name resolution log, a second mapping table of multiple reference IPv6 addresses included in the DNS domain name resolution log includes:

[0036] Perform domain name resolution based on the DNS domain name resolution log to obtain a correspondence between multiple reference IPv6 addresses and domain names included in the DNS domain name resolution log;

[0037] In the routing table corresponding to the domain name, query the routing prefix, AS, and IPv6 address interface type of each of the multiple reference IPv6 addresses;

[0038] Perform port detection on each of the multiple target IPv6 addresses whose IPv6 address interface type is a preset type, and determine detection results corresponding to the multiple target IPv6 addresses; the multiple target IPv6 addresses are part or all of the multiple reference IPv6 addresses;

[0039] Based on the detection result, determining an IPv6 application service address among the multiple target IPv6 addresses;

[0040] A second mapping table is obtained based on the routing prefix and AS corresponding to the IPv6 application service address.

[0041] Therefore, by performing domain name resolution on the DNS domain name resolution log, the routing prefix, AS, and IPv6 address interface class of multiple reference IPv6 addresses are obtained, and then port detection is performed on multiple target IPv6 addresses with a preset IPv6 address interface type, so that the IPv6 application service address in the multiple target IPv6 addresses can be determined, so as to provide effective reference data for judging whether the IPv6 address included in the AS is an application service address, increase the accuracy of the judgment, increase the number of identified IPv6 application service addresses, and provide data support for distinguishing network malicious traffic and network security attack and defense.

[0042] In some embodiments, the association information of the IPv6 address is the plurality of active IPv6 addresses;

[0043] The determining, based on the association information of the IPv6 address, a first mapping table corresponding to a plurality of reference IPv6 addresses included in the association information of the IPv6 address comprises:

[0044] Query the routing table to obtain the routing prefixes and ASs corresponding to the multiple active IPv6 addresses;

[0045] Aggregating the multiple active IPv6 addresses based on the routing prefix to obtain the number of active IPv6 addresses corresponding to each routing prefix and at least one active IPv6 address;

[0046] Sort the routing prefixes corresponding to the multiple active IPv6 addresses based on the number of active IPv6 addresses corresponding to each routing prefix to obtain a sorting result;

[0047] Based on the sorting result, selecting a preset number of multiple reference routing prefixes, and generating at least one reference IPv6 active address of the multiple reference routing prefixes using an IPv6 active address generation algorithm; the routing prefix includes the multiple reference routing prefixes;

[0048] Performing port detection on the multiple active IPv6 addresses and at least one reference active IPv6 address of the multiple reference routing prefixes, and determining detection results corresponding to the multiple active IPv6 addresses and at least one reference active IPv6 address of the multiple reference routing prefixes;

[0049] Based on the detection result, an IPv6 application service address among the multiple IPv6 active addresses and at least one reference IPv6 active address of the multiple reference routing prefixes is determined to obtain a first mapping table.

[0050] Therefore, by only analyzing multiple IPv6 active addresses, the multiple IPv6 active addresses are first aggregated based on the routing prefix, and then the IPv6 active address generation algorithm is further used to generate at least one reference IPv6 active address of multiple reference routing prefixes, thereby increasing the number of IPv6 active addresses. Finally, port detection is performed on the added IPv6 active addresses, so that the IPv6 application service addresses in the multiple IPv6 active addresses and at least one reference IPv6 active address of the multiple reference routing prefixes can be determined, thereby improving the efficiency of determining whether the IPv6 address included in the AS is an application service address and the amount of reference data, increasing the accuracy of the judgment, and increasing the number of identified IPv6 application service addresses, providing data support for distinguishing network malicious traffic and network security attack and defense.

[0051] In some embodiments, the associated information of the IPv6 address is a domain name resolution log of the DNS;

[0052] The determining, based on the association information of the IPv6 address, a first mapping table corresponding to the association information of the IPv6 address includes:

[0053] Performing domain name resolution based on the DNS domain name resolution log to obtain a correspondence between multiple reference IPv4 addresses and domain names included in the DNS domain name resolution log; the multiple reference IPv4 addresses are IPv4 application service addresses;

[0054] In the routing table corresponding to the domain name, query the routing prefix, AS, and geographical location of each of the multiple reference IPv4 addresses;

[0055] Query the routing tables corresponding to the ASs of the multiple reference IPv4 addresses to determine all routing prefixes of each AS;

[0056] For each AS: based on the routing prefixes of each of the multiple reference IPv4 addresses, the AS, and the geographical location of the IPv4 address, determining that the geographical locations of the IPv4 addresses corresponding to all routing prefixes of the AS are the same, and determining the IPv4 application service address included in the AS;

[0057] A first mapping table is obtained according to the correspondence between the IPv6 address and the IPv4 address, all routing prefixes of each AS, and the IPv4 application service address included in each AS.

[0058] Therefore, we first analyze the IPv4 addresses in the DNS domain name resolution log to determine the IPv4 application service address, and then through the association between IPv4 and IPv6, determine that the IPv6 address in the same geographical location is the IPv6 application service address. This improves the efficiency of determining whether the IPv6 address included in the AS is the application service address, increases the number of identified IPv6 application service addresses, and provides data support for distinguishing malicious network traffic and network security attacks and defenses.

[0059] In a second aspect, an embodiment of the present application provides a device for identifying an IPv6 application service address, the device comprising:

[0060] A first acquisition module is configured to acquire association information of an IPv6 address; the association information of the IPv6 address includes at least one of the following: a DNS domain name resolution log, semantic information corresponding to multiple ASs in an RIR, and multiple active IPv6 addresses;

[0061] A second acquisition module is used to obtain the total number of multiple routing prefixes included in each AS in the multiple ASs;

[0062] A mapping relationship determination module, configured to determine, based on the association information of the IPv6 address, a first mapping table corresponding to the association information of the IPv6 address; wherein the first mapping table includes a correspondence between the IPv6 application service address, the routing prefix, and the AS in a plurality of reference IPv6 addresses in the association information of the IPv6 address;

[0063] An identification module is used to determine, for each AS among the multiple ASs: if the ratio between the number of routing prefixes corresponding to the AS in the first mapping table and the total number of multiple routing prefixes included in the AS is greater than a preset ratio threshold, then it is determined that all IPv6 addresses included in the AS are application service addresses.

[0064] In some embodiments, the associated information of the IPv6 address is the domain name resolution log of the DNS; the mapping relationship determination module is specifically used to:

[0065] Perform domain name resolution based on the DNS domain name resolution log to obtain a correspondence between multiple reference IPv6 addresses and domain names included in the DNS domain name resolution log;

[0066] In the routing table corresponding to the domain name, query the routing prefix, AS, and IPv6 address interface type of each of the multiple reference IPv6 addresses;

[0067] Perform port detection on each of the multiple target IPv6 addresses whose IPv6 address interface type is a preset type, and determine detection results corresponding to the multiple target IPv6 addresses; the multiple target IPv6 addresses are part or all of the multiple reference IPv6 addresses;

[0068] Based on the detection result, determining an IPv6 application service address among the multiple target IPv6 addresses;

[0069] A first mapping table is obtained based on the routing prefix and AS corresponding to the IPv6 application service address.

[0070] In some embodiments, the mapping relationship determination module is specifically configured to:

[0071] For each target IPv6 address in the multiple target IPv6 addresses:

[0072] If the detection result of the target IPv6 address has a return value, it is determined that the target IPv6 address is an application service address.

[0073] In some embodiments, the association information of the IPv6 address is the domain name resolution log of the DNS and the semantic information corresponding to the multiple ASs in the RIR; the semantic information includes the identification field information and description information of the AS; the mapping relationship determination module is specifically used to:

[0074] Based on the DNS domain name resolution log, obtaining a second mapping table of multiple reference IPv6 addresses included in the DNS domain name resolution log; the second mapping table includes a correspondence between the IPv6 application service address, the routing prefix, and the AS in the multiple reference IPv6 addresses;

[0075] For each AS in the plurality of ASs: if the identification field information of the AS includes a preset keyword, the AS is determined to be a reference application service AS; the preset keyword includes IDC, Cloud, and CDN;

[0076] The first mapping table is obtained based on the correspondences among the multiple reference application service ASs, the IPv6 application service addresses in the multiple reference IPv6 addresses, and the routing prefixes included in the second mapping table.

[0077] In some embodiments, the mapping relationship determination module is specifically configured to:

[0078] Perform domain name resolution based on the DNS domain name resolution log to obtain a correspondence between multiple reference IPv6 addresses and domain names included in the DNS domain name resolution log;

[0079] In the routing table corresponding to the domain name, query the routing prefix, AS, and IPv6 address interface type of each of the multiple reference IPv6 addresses;

[0080] Perform port detection on each of the multiple target IPv6 addresses whose IPv6 address interface type is a preset type, and determine detection results corresponding to the multiple target IPv6 addresses; the multiple target IPv6 addresses are part or all of the multiple reference IPv6 addresses;

[0081] Based on the detection result, determining an IPv6 application service address among the multiple target IPv6 addresses;

[0082] A second mapping table is obtained based on the routing prefix and AS corresponding to the IPv6 application service address.

[0083] In some embodiments, the association information of the IPv6 address is the multiple active IPv6 addresses; and the mapping relationship determination module is specifically configured to:

[0084] Query the routing table to obtain the routing prefixes and ASs corresponding to the multiple active IPv6 addresses;

[0085] Aggregating the multiple active IPv6 addresses based on the routing prefix to obtain the number of active IPv6 addresses corresponding to each routing prefix and at least one active IPv6 address;

[0086] Sort the routing prefixes corresponding to the multiple active IPv6 addresses based on the number of active IPv6 addresses corresponding to each routing prefix to obtain a sorting result;

[0087] Based on the sorting result, selecting a preset number of multiple reference routing prefixes, and generating at least one reference IPv6 active address of the multiple reference routing prefixes using an IPv6 active address generation algorithm; the routing prefix includes the multiple reference routing prefixes;

[0088] Performing port detection on the multiple active IPv6 addresses and at least one reference active IPv6 address of the multiple reference routing prefixes, and determining detection results corresponding to the multiple active IPv6 addresses and at least one reference active IPv6 address of the multiple reference routing prefixes;

[0089] Based on the detection result, an IPv6 application service address among the multiple IPv6 active addresses and at least one reference IPv6 active address of the multiple reference routing prefixes is determined to obtain a first mapping table.

[0090] In some embodiments, the associated information of the IPv6 address is the domain name resolution log of the DNS; the mapping relationship determination module is specifically used to:

[0091] The determining, based on the association information of the IPv6 address, a first mapping table corresponding to the association information of the IPv6 address includes:

[0092] Performing domain name resolution based on the DNS domain name resolution log to obtain a correspondence between multiple reference IPv4 addresses and domain names included in the DNS domain name resolution log; the multiple reference IPv4 addresses are IPv4 application service addresses;

[0093] In the routing table corresponding to the domain name, query the routing prefix, AS, and geographical location of each of the multiple reference IPv4 addresses;

[0094] Query the routing tables corresponding to the ASs of the multiple reference IPv4 addresses to determine all routing prefixes of each AS;

[0095] For each AS: based on the routing prefixes of each of the multiple reference IPv4 addresses, the AS, and the geographical location of the IPv4 address, determining that the geographical locations of the IPv4 addresses corresponding to all routing prefixes of the AS are the same, and determining the IPv4 application service address included in the AS;

[0096] A first mapping table is obtained according to the correspondence between the IPv6 address and the IPv4 address, all routing prefixes of each AS, and the IPv4 application service address included in each AS.

[0097] In a third aspect, an embodiment of the present application provides an electronic device, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein:

[0098] The memory stores a computer program that can be executed by at least one processor. The computer program is executed by the at least one processor to enable the at least one processor to perform the above-mentioned method for identifying the IPv6 application service address.

[0099] In a fourth aspect, an embodiment of the present application provides a storage medium. When a computer program in the storage medium is executed by a processor of an electronic device, the electronic device can execute the above-mentioned method for identifying an IPv6 application service address.

[0100] In a fifth aspect, an embodiment of the present application provides a computer program product. When the computer program product is executed by an electronic device, the electronic device can implement the above-mentioned IPv6 application service address identification method provided in the present application.

[0101] Other features and advantages of the present application will be described in the following description, and in part will become apparent from the description, or will be understood by practicing the present application. The purposes and other advantages of the present application can be realized and obtained by the structures particularly pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0102] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0103] FIG1 is a flow chart of a method for identifying an IPv6 application service address provided in an embodiment of the present application;

[0104] FIG2 is a flow chart of a method for identifying an IPv6 application service address provided in an embodiment of the present application;

[0105] FIG3 is a schematic diagram of a complete flow chart of a method for identifying an IPv6 application service address provided in an embodiment of the present application;

[0106] FIG4 is a flow chart of a method for identifying an IPv6 application service address provided in an embodiment of the present application;

[0107] FIG5 is a flow chart of a method for identifying an IPv6 application service address provided in an embodiment of the present application;

[0108] FIG6 is a flow chart of a method for identifying an IPv6 application service address provided in an embodiment of the present application;

[0109] FIG7 is a schematic diagram of the structure of an apparatus for identifying an IPv6 application service address provided in an embodiment of the present application;

[0110] FIG8 is a schematic diagram of the hardware structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0111] To make the purpose, technical solutions, and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Among them, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0112] Moreover, in the description of the embodiments of the present application, unless otherwise specified, “ / ” means or, for example, A / B can mean A or B; “and / or” in the text is merely a description of the association relationship of associated objects, indicating that three relationships may exist, for example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. In addition, in the description of the embodiments of the present application, “multiple” refers to two or more than two.

[0113] In the following, the terms "first" and "second" are used for descriptive purposes only and should not be understood to imply or suggest relative importance or implicitly indicate the number of the technical features indicated. Therefore, features defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the embodiments of this application, unless otherwise specified, "plurality" means two or more.

[0114] To facilitate understanding of this application, the technical terms involved in this application are:

[0115] 1. IPv6 address

[0116] As 5G, cloud computing, the Internet of Things, and the Industrial Internet surge in the internet age, IPv4, with its limited 32-bit address space, is unable to meet the demands of the internet's continued growth. IPv6, with its ample 128-bit address space and its ability to provide greater communication efficiency and security, is the only means for sustained internet growth and the foundation for the development of the next generation internet.

[0117] IPv6 addresses are divided into three types in RFC4291: unicast addresses, anycast addresses, and multicast addresses. These three types of addresses have different uses and can meet different needs.

[0118] A unicast address is used to uniquely identify an interface, similar to the unicast address in IPv4. Data packets sent to a unicast address will be delivered to the interface identified by the address.

[0119] A multicast address is used to identify a group of interfaces, usually belonging to different nodes, similar to the multicast address in IPv4. Data packets sent to a multicast address are delivered to all interfaces identified by the address.

[0120] An anycast address is used to identify a group of interfaces, which usually belong to different nodes. A data packet sent to an anycast address is transmitted to the interface in the group of interfaces identified by this address that is closest to the source node (measured according to the routing protocol used).

[0121] The above IPv6 address classification method mainly classifies addresses based on their reachability and propagation methods. From the perspective of address usage, IPv6 addresses can be further divided into IPv6 client addresses, IPv6 transmission device addresses, and IPv6 application service addresses.

[0122] Among them, the IPv6 client address is mainly used to identify the address of the user-side device, including the addresses of daily-used hosts, mobile phones, tablets, and some IoT devices. It is the initiator address of network traffic transmission.

[0123] IPv6 transmission device addresses include addresses of routers, switches, firewalls, and other devices, and are the addresses of intermediate devices for network traffic transmission.

[0124] IPv6 application service addresses primarily include website servers, backend interface program servers, and middleware server addresses, and are the endpoints of network traffic transmission. IPv6 application service type address identification can be used to distinguish between data center traffic and non-data center traffic, providing data support for network security attack and defense.

[0125] 2. Autonomous System (AS)

[0126] RFC1930 defines an autonomous domain system as a group of routers that use the same interior gateway protocol within the autonomous domain and the same exterior gateway protocol to forward data packets outside the autonomous domain.

[0127] Simply put, an AS can be considered as a group of interconnected IP networks managed by a single management entity, such as a university, government, commercial organization or other type of ISP (Internet Service Provider).

[0128] AS is a collection of networks, which is both the infrastructure of cyberspace and the basic unit of Internet basic resources.

[0129] Each AS has an associated, internet-wide, unique Autonomous System Number (ASN). An ASN uniquely identifies each network within the interconnected network and is typically assigned by a regional administration center, such as the Asia-Pacific Network Information Center (APNIC).

[0130] Each autonomous region can announce one or more IPv4 / IPv6 routing prefixes. After the ISP assigns a routing prefix to a subordinate unit, the ISP router will send a router advertisement announcing the routing prefix. The routing prefix is ​​then incorporated into the AS in the region, and a mapping between the ASN and the routing prefix is ​​formed.

[0131] BGP (Border Gateway Protocol) is a standard protocol for exchanging routing information between autonomous systems (ASs). BGP allows one AS to advertise the reachability of its internal network, or the routing information of other networks reachable through that AS, to other ASes. After a network operator obtains an IP network segment and ASN, it broadcasts this information through BGP, allowing other network operators' networks to access this IP address segment.

[0132] There are currently approximately 100,000 registered AS numbers worldwide. These autonomous domain systems (ASs) can be categorized into access ASs, transport ASs, cloud service provider ASs, and CDN ASs based on their type.

[0133] RIRs are non-profit organizations that manage IP address registrations in their regions by running Whois services that record registrations of all address blocks and autonomous domain system information.

[0134] Each of the five major RIRs has its own Whois database, but there's no unified storage standard. For example, the owner object in LACNIC (Latin American and Caribbean Internet Address Registry) corresponds to the organization object in the other RIRs (with slightly different fields). ARIN (American Registry for Internet Numbers) has a customer object in addition to the organization object, but it only contains the name and address, lacking other important contact information. The following uses APNIC's Whois database as an example to introduce several objects involved in APNIC, including inet6num, route6, aut-num, organization, person, and role. The aut-num object contains detailed information about the registrant of an autonomous system number (AS number) and the routing policy of that AS. The fields involved primarily include aut-num, as-name, org, and admin-c.

[0135] 3. IPv6 domain name attributes

[0136] Domain name resolution refers to the process of converting a domain name into an IP address. DNS is responsible for completing domain name resolution, which involves resolving a domain name to an IP address and then binding a subdirectory to the domain name on the host at that IP address.

[0137] When a DNS server performs domain name resolution, it adds the following resolution records and generates domain name resolution logs: A record, AAAA record, PTR record, CNAME record, MX record, NS record, TXT record, SRV record, and URL record. AAAA record corresponds to the domain name to IPv6 mapping record.

[0138] Existing methods for identifying IP address application service types are mainly aimed at IPv4 addresses, and are classified through scanning detection, website mapping, and semantic analysis. Due to the huge IPv6 address space, traditional scanning-based methods are no longer suitable for IPv6 address application service type classification.

[0139] Therefore, there is an urgent need to provide a method that uses the characteristics of the IPv6 address space and the association between IPv6 and IPv4 addresses to identify IPv6 application service type addresses, providing data support for distinguishing malicious network traffic and network security attacks and defenses.

[0140] In view of this, the embodiments of the present application provide a method, apparatus, device and medium for identifying IPv6 application service addresses, which identify IPv6 application service type addresses and provide data support for distinguishing malicious network traffic and network security attacks and defenses.

[0141] The inventive concept of the embodiment of the present application: In the embodiment of the present application, the association information of the IPv6 address is obtained; the association information of the IPv6 address includes at least one of the following: the domain name resolution log of the DNS, the semantic information corresponding to multiple ASs in the RIR, and multiple active IPv6 addresses; the total number of multiple routing prefixes included in each AS in the multiple ASs is obtained; based on the association information of the IPv6 address, the first mapping table corresponding to the association information of the IPv6 address is determined; the first mapping table includes the correspondence between the IPv6 application service address, the routing prefix, and the AS in the multiple reference IPv6 addresses in the association information of the IPv6 address; for each AS: if the ratio between the number of routing prefixes corresponding to the AS in the first mapping table and the total number of multiple routing prefixes included in the AS is greater than a preset ratio threshold, it is determined that all IPv6 addresses included in the AS are application service addresses.

[0142] Therefore, by performing data analysis and distributed measurement on domain name resolution logs, analyzing the semantic information corresponding to the autonomous domain system AS, and the association between IPv4 and IPv6, it is determined whether the IPv6 address included in the AS is an application service address, effectively expanding the attribute dimension of the IPv6 address. By utilizing the semantic information of the AS and the symbiotic relationship between IPv6 and IPv4, the number of identified IPv6 application service addresses is increased through analysis and inference, providing data support for distinguishing malicious network traffic and network security attack and defense.

[0143] To further illustrate the technical solutions provided by the embodiments of the present application, the following is a detailed description of the technical solutions in conjunction with the accompanying drawings and specific implementation methods. Although the embodiments of the present application provide the method operation steps as shown in the following embodiments or drawings, more or fewer operation steps may be included in the method based on routine or no creative work. In steps where there is no necessary causal relationship logically, the execution order of these steps is not limited to the execution order provided in the embodiments of the present application.

[0144] Referring to FIG1 , there is shown a flow chart of a method for identifying an IPv6 application service address provided in an embodiment of the present application. The method comprises the steps shown in FIG1 :

[0145] In step 101, information associated with an IPv6 address is obtained; the information associated with the IPv6 address includes at least one of the following: a DNS domain name resolution log, semantic information corresponding to multiple ASs in an RIR, and multiple active IPv6 addresses;

[0146] In step 102, a total number of multiple routing prefixes included in each of the multiple ASs is obtained;

[0147] In step 103, based on the association information of the IPv6 address, a first mapping table corresponding to the association information of the IPv6 address is determined; the first mapping table includes a correspondence between the IPv6 application service address, the routing prefix, and the AS in the plurality of reference IPv6 addresses in the association information of the IPv6 address;

[0148] In step 104, for each AS in the multiple ASs: if the ratio between the number of routing prefixes corresponding to the AS in the first mapping table and the total number of multiple routing prefixes included in the AS is greater than a preset ratio threshold, it is determined that all IPv6 addresses included in the AS are application service addresses.

[0149] Specifically, the method for identifying the IPv6 application service address in this application mainly includes four schemes, which are introduced in detail below.

[0150] Solution 1: The associated information of the IPv6 address includes the DNS domain name resolution log. The specific steps are shown in Figure 2:

[0151] In step 201, a DNS domain name resolution log is obtained, and the total number of multiple routing prefixes included in each of multiple ASs is obtained.

[0152] In step 202, based on the DNS domain name resolution log, a first mapping table corresponding to the DNS domain name resolution log is determined; the first mapping table includes the correspondence between the IPv6 application service address, routing prefix, and AS in multiple reference IPv6 addresses in the DNS domain name resolution log.

[0153] In some embodiments, in step 202, determining the first mapping table corresponding to the association information of the IPv6 address based on the association information of the IPv6 address may be specifically performed as follows:

[0154] Perform domain name resolution based on the DNS domain name resolution log to obtain a correspondence between multiple reference IPv6 addresses and domain names included in the DNS domain name resolution log;

[0155] In the routing table corresponding to the domain name, query the routing prefix, AS, and IPv6 address interface type of each of the multiple reference IPv6 addresses;

[0156] Performing port detection on each of a plurality of target IPv6 addresses of a preset IPv6 address interface type, and determining detection results corresponding to the plurality of target IPv6 addresses; the plurality of target IPv6 addresses being part or all of the plurality of reference IPv6 addresses;

[0157] Determine the IPv6 application service address among multiple target IPv6 addresses based on the detection result;

[0158] Obtain the first mapping table based on the routing prefix and AS corresponding to the IPv6 application service address.

[0159] In some embodiments, the above-mentioned determining the IPv6 application service address among multiple target IPv6 addresses based on the detection result can be executed as follows: for each target IPv6 address among the multiple target IPv6 addresses: if the detection result of the target IPv6 address has a return value, then determine the target IPv6 address as the application service address.

[0160] In step 203, for each AS among the multiple ASs: if the ratio between the number of routing prefixes corresponding to the AS in the first mapping table and the total number of multiple routing prefixes included in the AS is greater than the preset ratio threshold, then determine that all IPv6 addresses included in the AS are application service addresses.

[0161] Exemplarily, the number of routing prefixes corresponding to the AS in the first mapping table is denoted as n, the total number of multiple routing prefixes included in the AS is denoted as m, and the preset ratio threshold is 0.8. If n / m > 0.8, then it is considered that all IPv6 addresses included in all routing prefixes of this AS are application service addresses.

[0162] Therefore, Solution 1 can be specifically implemented as the steps shown in Figure 3:

[0163] A1: Obtain the mapping relationship between the domain name and the IP address from the domain name resolution log of the DNS resolver, and extract the domain name-IPv6 mapping list.

[0164] Among them, the content of the domain name-IPv6 mapping list is <reference IPv6 address, domain name>, which represents the correspondence between multiple reference IPv6 addresses included in the domain name resolution log and the domain name.

[0165] A2: Query the routing prefix, AS, and IPv6 address interface type to which each reference IPv6 address in the domain name-IPv6 mapping list in step A1 belongs in the routing table, and form a new mapping table.

[0166] The content of the new mapping table is <IPv6 address, domain name, IPv6 routing prefix, AS, IPv6 address interface type>.

[0167] A3: Analyze the IPv6 address interface types included in the routing prefixes in the new mapping table obtained in step A2. If the IPv6 address interface types are port increment type and random number type, perform active port probing on the reference IPv6 addresses with port increment type and random number type in sequence for the IPv6 address interface types. If there is a return value in the probing result, determine the corresponding reference IPv6 address as the application service address, and add this reference IPv6 address, the corresponding routing prefix, and the AS to the first mapping table.

[0168] The content of the first mapping table is <IPv6 application service address, IPv6 routing prefix, AS>.

[0169] Among them, when performing active port probing, the ports may include 80, 102, 1080, 22, 23, 25, 3306, 3389, 443, 49152, 5060, 53, 7001, 8000, 8001, 8080, 8081, 8888, and the embodiments of the present application do not limit this.

[0170] A4: Count the number of routing prefixes of each AS in the first mapping table, denoted as n, and at the same time obtain the total number of multiple routing prefixes included in this AS, denoted as m. The preset ratio threshold is 0.8. If n / m > 0.8, it is considered that all the IPv6 addresses included in the routing prefixes of this AS are application service addresses.

[0171] Thus, obtain the DNS domain name resolution log, obtain the mapping relationship between the domain name and the IPv6 address through distributed probing and data parsing, obtain the mapping relationship between the routing prefix set of the IPv6 address and the autonomous domain system AS, and infer more IPv6 application service addresses in the AS according to the ratio between the number of routing prefixes of each AS in the mapping relationship and the total number of routing prefixes of the AS.

[0172] Solution 2: The associated information of the IPv6 address is the DNS domain name resolution log and the semantic information corresponding to multiple ASs in the RIR; the semantic information includes the identification field information and the description information of the AS; the specific steps are shown in Figure 4:

[0173] In step 401, obtain the DNS domain name resolution log, the semantic information corresponding to multiple ASs in the RIR, and obtain the total number of multiple routing prefixes included in each AS among the multiple ASs.

[0174] In step 402, based on the DNS domain name resolution log and the semantic information corresponding to multiple ASs in the RIR, determine the first mapping table; the first mapping table includes the corresponding relationship between the IPv6 application service addresses, routing prefixes, and ASs among multiple reference IPv6 addresses of the DNS domain name resolution log and the semantic information corresponding to multiple ASs in the RIR.

[0175] In some embodiments, in the present application, determining the first mapping table based on the DNS domain name resolution log and the semantic information corresponding to multiple ASs in the RIR may be performed as follows:

[0176] S1: Based on the DNS domain name resolution log, obtain a second mapping table of multiple reference IPv6 addresses included in the DNS domain name resolution log; the second mapping table includes the correspondence between the IPv6 application service addresses, routing prefixes, and ASs in the multiple reference IPv6 addresses;

[0177] S2: For each AS among the multiple ASs: if the identification field information of the AS contains a preset keyword, the AS is determined to be a reference application service AS; the preset keywords include IDC, Cloud, and CDN;

[0178] S3: Based on the correspondences among the multiple reference application service ASs, the IPv6 application service addresses in the multiple reference IPv6 addresses, and the routing prefixes included in the second mapping table, a first mapping table is obtained.

[0179] The method for obtaining the second mapping table of multiple reference IPv6 addresses included in the DNS domain name resolution log based on the DNS domain name resolution log in step S1 is the same as the specific implementation of step 202 in solution 1, and is performed as follows:

[0180] Perform domain name resolution based on the DNS domain name resolution log to obtain a correspondence between multiple reference IPv6 addresses and domain names included in the DNS domain name resolution log;

[0181] In the routing table corresponding to the domain name, query the routing prefix, AS, and IPv6 address interface type of each of the multiple reference IPv6 addresses;

[0182] Performing port detection on each of a plurality of target IPv6 addresses having a preset IPv6 address interface type, and determining detection results corresponding to the plurality of target IPv6 addresses; the plurality of target IPv6 addresses being part or all of the plurality of reference IPv6 addresses;

[0183] Based on the detection result, determine the IPv6 application service address among the multiple target IPv6 addresses;

[0184] A second mapping table is obtained based on the routing prefix and AS corresponding to the IPv6 application service address.

[0185] In some embodiments, determining the IPv6 application service address among multiple target IPv6 addresses based on the detection result may be performed as follows: for each target IPv6 address among the multiple target IPv6 addresses: if the detection result of the target IPv6 address has a return value, then determine the target IPv6 address as the application service address.

[0186] In step 403, for each AS among multiple ASs: if the ratio between the number of routing prefixes corresponding to the AS in the first mapping table and the total number of multiple routing prefixes included in the AS is greater than the preset ratio threshold, then determine that all IPv6 addresses included in the AS are application service addresses.

[0187] Exemplarily, the number of routing prefixes corresponding to the AS in the first mapping table is denoted as n, the total number of multiple routing prefixes included in the AS is denoted as m, and the preset ratio threshold is 0.8. If n / m > 0.8, then it is considered that all IPv6 addresses included in all routing prefixes of this AS are application service addresses.

[0188] Therefore, Solution 2 can be specifically implemented as the steps shown in Figure 3:

[0189] B1: Obtain the semantic information corresponding to multiple ASs from the RIR, including the identification field information (name) and description information of the AS.

[0190] B2: Analyze whether the identification field information of the AS contains a preset keyword; if it includes the preset keyword, then determine the AS as the reference application service AS and obtain a list of reference application service ASs.

[0191] Among them, the preset keywords include IDC, Cloud, and CDN.

[0192] B3: Traverse each reference application service AS in the list of reference application service ASs in B2, query the routing table, obtain all IPv6 routing prefixes included in the reference application service AS, and form a new AS information table.

[0193] The content of the new AS information table is <AS, IPv6 routing prefix>, representing the corresponding relationship between the reference application service AS and the routing prefix.

[0194] B4: Based on the DNS domain name resolution log, obtain a second mapping table of multiple reference IPv6 addresses included in the DNS domain name resolution log.

[0195] Among them, the second mapping table includes the corresponding relationship between the IPv6 application service address, the routing prefix, and the AS among multiple reference IPv6 addresses.

[0196] B5: Obtain multiple reference application service ASs, and multiple IPv6 application service addresses and routing prefixes corresponding to the multiple reference application service ASs from the second mapping table to generate a first mapping table.

[0197] The content of the first mapping table is <reference application service AS, IPv6 routing prefix, IPv6 application service address>, which represents the correspondence between the reference application service AS, the IPv6 application service address, and the routing prefix.

[0198] B6: Traverse the new AS information table in B3, match the IPv6 routing prefix of each reference application service AS with the content of the first mapping table based on the key value, record the number of routing prefixes of each reference application service AS in the first mapping table as n, and obtain all routing prefixes included in the reference application service AS at the same time, record them as m. The preset ratio threshold is 0.8. If n / m>0.8, it is considered that the IPv6 addresses contained in all routing prefixes of the reference application service AS are application service addresses.

[0199] Therefore, the semantic information of the AS that supports IPv6 addresses is analyzed, and the AS type is first determined based on the semantic information of the AS. Then, the routing prefix of the AS of the application service is matched with the content of the first mapping table, and then the Pv6 addresses of all IPv6 routing prefixes contained therein are determined to be IPv6 application service addresses.

[0200] Solution 3: The associated information of the IPv6 address is multiple active IPv6 addresses. The specific steps are shown in Figure 5:

[0201] In step 501, the routing table is queried to obtain routing prefixes and ASs corresponding to multiple active IPv6 addresses.

[0202] In step 502, multiple active IPv6 addresses are aggregated based on the routing prefix to obtain the number of active IPv6 addresses corresponding to each routing prefix and at least one active IPv6 address.

[0203] In step 503, based on the number of active IPv6 addresses corresponding to each routing prefix, the routing prefixes corresponding to the multiple active IPv6 addresses are sorted to obtain a sorting result.

[0204] In step 504, based on the sorting result, a preset number of reference routing prefixes are selected, and at least one reference IPv6 active address of the multiple reference routing prefixes is generated using an IPv6 active address generation algorithm; the routing prefix includes multiple reference routing prefixes.

[0205] In step 505, port probing is performed on at least one reference IPv6 active address among multiple IPv6 active addresses and multiple reference route prefixes, and the probing results corresponding to at least one reference IPv6 active address among multiple IPv6 active addresses and multiple reference route prefixes are determined.

[0206] In step 506, based on the probing results, the IPv6 application service address among at least one reference IPv6 active address among multiple IPv6 active addresses and multiple reference route prefixes is determined, and a first mapping table is obtained.

[0207] In some embodiments, the above-mentioned determining the IPv6 application service address among at least one reference IPv6 active address among multiple IPv6 active addresses and multiple reference route prefixes based on the probing results can be implemented as follows: for each IPv6 address among at least one reference IPv6 active address among multiple IPv6 active addresses and multiple reference route prefixes: if there is a return value in the probing result of the IPv6 address, then determine that the IPv6 address is an application service address.

[0208] The content of the first mapping table is <IPv6 application service address, IPv6 route prefix, AS>, which represents the correspondence relationship among the IPv6 application service address, AS, and route prefix among at least one reference IPv6 active address among multiple IPv6 active addresses and multiple reference route prefixes.

[0209] In step 507, for each AS among multiple ASs: if the ratio between the number of route prefixes corresponding to the AS in the first mapping table and the total number of multiple route prefixes included in the AS is greater than a preset ratio threshold, then determine that all IPv6 addresses included in the AS are application service addresses.

[0210] Exemplarily, the number of route prefixes corresponding to the AS in the first mapping table is denoted as n, the total number of multiple route prefixes included in the AS is denoted as m, and the preset ratio threshold is 0.8. If n / m > 0.8, then it is considered that all IPv6 addresses included in all route prefixes of the AS are application service addresses.

[0211] Therefore, Solution 3 can be specifically implemented as the steps shown in Figure 3:

[0212] C1: Obtain multiple IPv6 active addresses, query the route prefixes and ASs corresponding to the multiple IPv6 active addresses in the routing table, and form an IPv6 active address probing table.

[0213] The content of the IPv6 active address probing table is <IPv6 active address, IPv6 route prefix, AS>, which represents the correspondence relationship among the IPv6 active address, route prefix, and AS.

[0214] C2: Aggregate the IPv6 active addresses in the IPv6 active address detection table with the IPv6 routing prefix, and sort them in descending order according to the number of IPv6 active addresses included in the IPv6 routing prefix, to form an IPv6 active address routing prefix table.

[0215] The content of the IPv6 active address routing prefix table is <IPv6 routing prefix, number of IPv6 active addresses, list of IPv6 active addresses, AS of the IPv6 active address>, representing the corresponding relationship between the IPv6 routing prefix, the number of IPv6 active addresses, the list of IPv6 active addresses, and the AS of the IPv6 active address. The list of IPv6 active addresses includes at least one IPv6 active address corresponding to the IPv6 routing prefix.

[0216] C3: According to the sorting result, select the top 20% of the IPv6 routing prefixes as reference routing prefixes, and use the IPv6 active address generation algorithm to generate multiple new reference IPv6 active addresses, and add them to the list of IPv6 active addresses corresponding to the corresponding routing prefix.

[0217] C4: Traverse the IPv6 active address routing prefix table with multiple reference IPv6 active addresses added, and perform port detection on each IPv6 active address and reference IPv6 active address in the table. The detected ports include common application service ports. If there is a return value for the IPv6 active address port, then determine that the IPv6 active address or the reference IPv6 active address is an IPv6 application service address, and form a first mapping table.

[0218] The content of the first mapping table is <IPv6 application service address, active service port, routing prefix, AS>, representing the corresponding relationship between the IPv6 application service address, the active service port, the routing prefix, and the AS.

[0219] C5: Count the number of routing prefixes of each AS in the first mapping table, denoted as n, and at the same time obtain the total number of multiple routing prefixes included in this AS, denoted as m. The preset ratio threshold is 0.8. If n / m > 0.8, then consider that all IPv6 addresses included in the routing prefixes of this AS are application service addresses.

[0220] In some embodiments, when traversing the IPv6 active address routing prefix table with multiple reference IPv6 active addresses added in step C4 and performing port detection on each IPv6 active address and reference IPv6 active address in the table, the IPv6 active address interface type of each IPv6 active address and reference IPv6 active address can be obtained, and then the IPv6 active addresses or reference IPv6 active addresses with the IPv6 active address interface type of port increment and random number type are sequentially subjected to active port detection.

[0221] Therefore, by collecting multiple active IPv6 addresses and performing routing prefix aggregation on the active IPv6 addresses, new active IPv6 addresses are generated, and more active IPv6 addresses are obtained; according to the distribution of active IPv6 addresses, a small amount of distributed detection is performed on the active IPv6 addresses to perform port detection, and according to the properties of the ports, it is inferred that the active IPv6 addresses are application service addresses, thereby judging that the IPv6 addresses of all IPv6 routing prefixes contained in the AS corresponding to the application service address are IPv6 application service addresses.

[0222] Solution 4: The associated information of the IPv6 address is the DNS domain name resolution log; the specific steps are shown in Figure 6:

[0223] In step 601, domain name resolution is performed based on the DNS domain name resolution log to obtain a correspondence between multiple reference IPv4 addresses and domain names included in the DNS domain name resolution log; the multiple reference IPv4 addresses are IPv4 application service addresses;

[0224] In step 602, the routing table corresponding to the domain name is searched for the routing prefix, AS, and geographic location of each of the multiple reference IPv4 addresses;

[0225] In step 603, the routing tables corresponding to the ASs of the multiple reference IPv4 addresses are queried to determine all routing prefixes of each AS;

[0226] In step 604, for each AS: based on the routing prefixes of the multiple reference IPv4 addresses, the AS, and the geographical location of the IPv4 address, determining that the geographical locations of the IPv4 addresses corresponding to all routing prefixes of the AS are the same, and determining the IPv4 application service address included in the AS;

[0227] In step 605, a first mapping table is obtained according to the correspondence between IPv6 addresses and IPv4 addresses, all routing prefixes of each AS, and the IPv4 application service addresses included in each AS.

[0228] In step 606, for each AS in the multiple ASs: if the ratio between the number of routing prefixes corresponding to the AS in the first mapping table and the total number of multiple routing prefixes included in the AS is greater than a preset ratio threshold, it is determined that all IPv6 addresses included in the AS are application service addresses.

[0229] For example, the number of routing prefixes corresponding to the AS in the first mapping table is recorded as n, the total number of multiple routing prefixes included in the AS is recorded as m, and the preset ratio threshold is 0.8. If n / m>0.8, it is considered that the IPv6 addresses contained in all routing prefixes of the AS are application service addresses.

[0230] Therefore, Solution 4 can be specifically implemented as the steps shown in Figure 3:

[0231] D1: Obtain the mapping relationship between domain names and IPv4 addresses from the DNS domain name resolution log, and query the routing table for the routing prefix, AS, and geographical location of the IPv4 address corresponding to the IPv4 address to form an IPv4 application service table.

[0232] The IPv4 address is the IPv4 application service address. The geographical location of the IPv4 address is the city where the IPv4 address is located.

[0233] The content of the IPv4 application service table is <IPv4 application service address, routing prefix, AS, geographical location of the IPv4 address>, representing the correspondence between the IPv4 application service address, routing prefix, AS, and geographical location of the IPv4 address.

[0234] D2: Extract the ASes that appear in the IPv4 application service table, query the routing table to obtain all the routing prefixes of the AS, compare with the IPv4 application service table, query the IPv4 application service addresses included in each routing prefix, and query the geographical location corresponding to the IPv4 application service addresses included in the routing prefix to form a new table; if the geographical locations of the IPv4 addresses corresponding to all the routing prefixes of the AS are the same, then based on the IPv4 application service address, the corresponding AS, and the routing prefix, obtain the first mapping table.

[0235] The content of the new table is <AS, routing prefix, IPv4 application service address, geographical location of the IPv4 address>.

[0236] If the geographical locations of the IPv4 addresses corresponding to all the routing prefixes of the AS are the same, it is considered that the types of the IPv4 addresses and IPv6 addresses corresponding to all the routing prefixes of the AS are the same, that is, the IPv4 address of the AS is the IPv4 application service address, and the routing prefix corresponding to the IPv4 address also includes the IPv6 application service address. Thus, based on the IPv4 application service address, the corresponding AS, and the routing prefix, obtain the first mapping table. The content of the first mapping table is <AS, routing prefix, application service>, representing the correspondence between the AS, routing prefix, and application service address.

[0237] D3: If the number of routing prefixes of each AS including the application service in the first mapping table is denoted as n, and at the same time obtain the total number of multiple routing prefixes included in the AS, denoted as m, and the preset ratio threshold is 0.8, if n / m > 0.8, then it is considered that all the IPv6 addresses included in all the routing prefixes of the AS are application service addresses.

[0238] Therefore, through the symbiotic relationship between IPv4 addresses and IPv6 addresses, on the basis that the address positions of all IPv4 addresses in the AS corresponding to the IPv4 address are the same, it is considered that the routing prefix with the IPv4 application service address in the AS also includes the IPv6 application service address. Therefore, the AS type to which it belongs is determined based on the aggregation scale of the IPv4 addresses, and then the IPv6 addresses of all routing prefixes contained in the AS corresponding to the routing prefix with the IPv4 application service address are determined to be IPv6 application service addresses.

[0239] Based on the foregoing description, the association information of the IPv6 address is obtained; the association information of the IPv6 address includes at least one of the following: a domain name resolution log of the DNS, semantic information corresponding to multiple ASs in the RIR, and multiple active IPv6 addresses; the total number of multiple routing prefixes included in each AS in the multiple ASs is obtained; based on the association information of the IPv6 address, a first mapping table corresponding to the association information of the IPv6 address is determined; the first mapping table includes the correspondence between the IPv6 application service address, routing prefix, and AS in multiple reference IPv6 addresses in the association information of the IPv6 address; for each AS: if the ratio between the number of routing prefixes corresponding to the AS in the first mapping table and the total number of multiple routing prefixes included in the AS is greater than a preset ratio threshold, it is determined that all IPv6 addresses included in the AS are application service addresses.

[0240] Therefore, by performing data analysis and distributed measurement on domain name resolution logs, analyzing the semantic information corresponding to the autonomous domain system AS, and the association between IPv4 and IPv6, it is determined whether the IPv6 address included in the AS is an application service address, effectively expanding the attribute dimension of the IPv6 address. By utilizing the semantic information of the AS and the symbiotic relationship between IPv6 and IPv4, the number of identified IPv6 application service addresses is increased through analysis and inference, providing data support for distinguishing malicious network traffic and network security attack and defense.

[0241] Based on the same technical concept, an embodiment of the present application also provides an IPv6 application service address identification device. The principle of solving the problem by the IPv6 application service address identification device is similar to the above-mentioned IPv6 application service address identification method. Therefore, the implementation of the IPv6 application service address identification device can refer to the implementation of the IPv6 application service address identification method, and the repeated parts will not be repeated.

[0242] FIG7 is a schematic structural diagram of an apparatus for identifying an IPv6 application service address provided in an embodiment of the present application. The apparatus includes a first acquisition module 701 , a second acquisition module 702 , a mapping relationship determination module 703 , and an identification module 704 .

[0243] The first acquisition module 701 is configured to acquire information associated with an IPv6 address; the information associated with the IPv6 address includes at least one of the following: a DNS domain name resolution log, semantic information corresponding to multiple ASs in an RIR, and multiple active IPv6 addresses;

[0244] A second obtaining module 702 is configured to obtain a total number of multiple routing prefixes included in each of the multiple ASs;

[0245] A mapping relationship determination module 703 is configured to determine, based on the association information of the IPv6 address, a first mapping table corresponding to the association information of the IPv6 address; the first mapping table including a correspondence between the IPv6 application service address, the routing prefix, and the AS in the plurality of reference IPv6 addresses in the association information of the IPv6 address;

[0246] Identification module 704 is used to, for each AS among the multiple ASs: if the ratio between the number of routing prefixes corresponding to the AS in the first mapping table and the total number of multiple routing prefixes included in the AS is greater than a preset ratio threshold, it is determined that all IPv6 addresses included in the AS are application service addresses.

[0247] In some embodiments, the associated information of the IPv6 address is the domain name resolution log of the DNS; the mapping relationship determination module 703 is specifically used to:

[0248] Perform domain name resolution based on the DNS domain name resolution log to obtain a correspondence between multiple reference IPv6 addresses and domain names included in the DNS domain name resolution log;

[0249] In the routing table corresponding to the domain name, query the routing prefix, AS, and IPv6 address interface type of each of the multiple reference IPv6 addresses;

[0250] Perform port detection on each of the multiple target IPv6 addresses whose IPv6 address interface type is a preset type, and determine detection results corresponding to the multiple target IPv6 addresses; the multiple target IPv6 addresses are part or all of the multiple reference IPv6 addresses;

[0251] Based on the detection result, determining an IPv6 application service address among the multiple target IPv6 addresses;

[0252] A first mapping table is obtained based on the routing prefix and AS corresponding to the IPv6 application service address.

[0253] In some embodiments, the mapping relationship determination module 703 is specifically configured to:

[0254] For each target IPv6 address in the multiple target IPv6 addresses:

[0255] If the detection result of the target IPv6 address has a return value, it is determined that the target IPv6 address is an application service address.

[0256] In some embodiments, the association information of the IPv6 address is the domain name resolution log of the DNS and the semantic information corresponding to the multiple ASs in the RIR; the semantic information includes the identification field information and description information of the AS; the mapping relationship determination module 703 is specifically used to:

[0257] Based on the DNS domain name resolution log, obtaining a second mapping table of multiple reference IPv6 addresses included in the DNS domain name resolution log; the second mapping table includes a correspondence between the IPv6 application service address, the routing prefix, and the AS in the multiple reference IPv6 addresses;

[0258] For each AS in the plurality of ASs: if the identification field information of the AS includes a preset keyword, the AS is determined to be a reference application service AS; the preset keyword includes IDC, Cloud, and CDN;

[0259] The first mapping table is obtained based on the correspondences among the multiple reference application service ASs, the IPv6 application service addresses in the multiple reference IPv6 addresses, and the routing prefixes included in the second mapping table.

[0260] In some embodiments, the mapping relationship determination module 703 is specifically configured to:

[0261] Perform domain name resolution based on the DNS domain name resolution log to obtain a correspondence between multiple reference IPv6 addresses and domain names included in the DNS domain name resolution log;

[0262] In the routing table corresponding to the domain name, query the routing prefix, AS, and IPv6 address interface type of each of the multiple reference IPv6 addresses;

[0263] Perform port detection on each of the multiple target IPv6 addresses whose IPv6 address interface type is a preset type, and determine detection results corresponding to the multiple target IPv6 addresses; the multiple target IPv6 addresses are part or all of the multiple reference IPv6 addresses;

[0264] Based on the detection result, determining an IPv6 application service address among the multiple target IPv6 addresses;

[0265] A second mapping table is obtained based on the routing prefix and AS corresponding to the IPv6 application service address.

[0266] In some embodiments, the association information of the IPv6 address is the multiple active IPv6 addresses; the mapping relationship determination module 703 is specifically configured to:

[0267] Query the routing table to obtain the routing prefixes and ASs corresponding to the multiple active IPv6 addresses;

[0268] Aggregating the multiple active IPv6 addresses based on the routing prefix to obtain the number of active IPv6 addresses corresponding to each routing prefix and at least one active IPv6 address;

[0269] Sort the routing prefixes corresponding to the multiple active IPv6 addresses based on the number of active IPv6 addresses corresponding to each routing prefix to obtain a sorting result;

[0270] Based on the sorting result, selecting a preset number of multiple reference routing prefixes, and generating at least one reference IPv6 active address of the multiple reference routing prefixes using an IPv6 active address generation algorithm; the routing prefix includes the multiple reference routing prefixes;

[0271] Performing port detection on the multiple active IPv6 addresses and at least one reference active IPv6 address of the multiple reference routing prefixes, and determining detection results corresponding to the multiple active IPv6 addresses and at least one reference active IPv6 address of the multiple reference routing prefixes;

[0272] Based on the detection result, an IPv6 application service address among the multiple IPv6 active addresses and at least one reference IPv6 active address of the multiple reference routing prefixes is determined to obtain a first mapping table.

[0273] In some embodiments, the associated information of the IPv6 address is the domain name resolution log of the DNS; the mapping relationship determination module 703 is specifically used to:

[0274] The determining, based on the association information of the IPv6 address, a first mapping table corresponding to the association information of the IPv6 address includes:

[0275] Performing domain name resolution based on the DNS domain name resolution log to obtain a correspondence between multiple reference IPv4 addresses and domain names included in the DNS domain name resolution log; the multiple reference IPv4 addresses are IPv4 application service addresses;

[0276] In the routing table corresponding to the domain name, query the routing prefix, AS, and geographical location of each of the multiple reference IPv4 addresses;

[0277] Query the routing tables corresponding to the ASs of the multiple reference IPv4 addresses to determine all routing prefixes of each AS;

[0278] For each AS: based on the routing prefixes of each of the multiple reference IPv4 addresses, the AS, and the geographical location of the IPv4 address, determining that the geographical locations of the IPv4 addresses corresponding to all routing prefixes of the AS are the same, and determining the IPv4 application service address included in the AS;

[0279] A first mapping table is obtained according to the correspondence between the IPv6 address and the IPv4 address, all routing prefixes of each AS, and the IPv4 application service address included in each AS.

[0280] The division of modules in the embodiments of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation. In addition, the functional modules in the embodiments of the present application may be integrated into one processor, or may exist physically separately, or two or more modules may be integrated into one module. The coupling between the modules can be achieved through some interfaces, which are usually electrical communication interfaces, but it is not ruled out that they may be mechanical interfaces or other forms of interfaces. Therefore, the modules described as separate components may or may not be physically separated, and may be located in one place or distributed to different locations of the same or different devices. The above-mentioned integrated modules can be implemented in the form of hardware or in the form of software functional modules.

[0281] After introducing the method and apparatus for identifying an IPv6 application service address according to an exemplary embodiment of the present application, an electronic device according to another exemplary embodiment of the present application is introduced next.

[0282] The electronic device 130 implemented according to this embodiment of the present application is described below with reference to Figure 8. The electronic device 130 shown in Figure 8 is only an example and should not bring any limitation to the functions and scope of use of the embodiment of the present application.

[0283] As shown in Figure 8, electronic device 130 is a general electronic device. Components of electronic device 130 may include, but are not limited to, at least one processor 131, at least one memory 132, and a bus 133 connecting different system components (including memory 132 and processor 131).

[0284] Bus 133 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, and a processor or local bus using any of a variety of bus architectures.

[0285] The memory 132 may include a readable medium in the form of a volatile memory, such as a random access memory (RAM) 1321 and / or a cache memory 1322 , and may further include a read-only memory (ROM) 1323 .

[0286] The memory 132 may also include a program / utility 1325 having a set (at least one) of program modules 1324, such program modules 1324 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0287] The electronic device 130 may also communicate with one or more external devices 134 (e.g., a keyboard, pointing device, etc.), one or more devices that enable a user to interact with the electronic device 130, and / or any device that enables the electronic device 130 to communicate with one or more other electronic devices (e.g., a router, a modem, etc.). Such communication may occur via an input / output (I / O) interface 135. Furthermore, the electronic device 130 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network such as the Internet) via a network adapter 136. As shown, the network adapter 136 communicates with other modules of the electronic device 130 via a bus 133. It should be understood that, although not shown, other hardware and / or software modules may be used in conjunction with the electronic device 130, including but not limited to microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0288] In an exemplary embodiment, a storage medium is also provided. When a computer program in the storage medium is executed by a processor of an electronic device, the electronic device can perform any of the above-mentioned methods for identifying an IPv6 application service address. Optionally, the storage medium can be a non-transitory computer-readable storage medium, for example, a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0289] In an exemplary embodiment, the electronic device of the present application may include at least one processor and a memory communicatively connected to the at least one processor, wherein the memory stores a computer program that can be executed by the at least one processor, and when the computer program is executed by the at least one processor, the at least one processor can execute the steps of any IPv6 application service address identification method provided in the embodiments of the present application.

[0290] In an exemplary embodiment, a computer program product is further provided. When the computer program product is executed by an electronic device, the electronic device can implement any exemplary method provided in this application.

[0291] Furthermore, the computer program product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or component, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, RAM, ROM, an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0292] In the embodiments of the present application, the program product for device discovery may be a CD-ROM and include program code, and may be run on a computing device. However, the program product of the present application is not limited thereto. In this document, a readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0293] A readable signal medium may include a data signal transmitted in baseband or as part of a carrier wave, which carries readable program code. Such a transmitted data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium that can transmit, propagate, or transfer a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0294] The program code contained on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, radio frequency (RF), etc., or any suitable combination of the foregoing.

[0295] The program code for performing the operations of the present application can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, such as a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0296] It should be noted that although several units or subunits of the device are mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, depending on the embodiment of the application, the features and functions of two or more units described above can be embodied in a single unit. Conversely, the features and functions of a single unit described above can be further divided and embodied by multiple units.

[0297] Furthermore, although the operations of the method of the present application are described in a particular order in the accompanying drawings, this does not require or imply that the operations must be performed in this particular order, or that all illustrated operations must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps.

[0298] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0299] The present application is described with reference to the flowchart and / or block diagram of the method, device (system), and computer program product according to the embodiment of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, and the combination of the process and / or box in the flowchart and / or block diagram can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for implementing the function specified in one process or multiple processes in the flowchart and / or one box or multiple boxes in the block diagram.

[0300] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0301] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0302] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0303] Obviously, those skilled in the art may make various modifications and variations to this application without departing from the scope of protection of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A method for identifying an IPv6 application service address, characterized in that: The method comprises: Obtaining information associated with an Internet Protocol version 6 IPv6 address; the information associated with the IPv6 address includes at least one of the following: a domain name resolution log of a domain name system server DNS, semantic information corresponding to multiple autonomous domain systems AS in a regional Internet registry RIR, and multiple IPv6 active addresses; Obtain a total number of multiple routing prefixes included in each AS in the multiple ASs; Based on the association information of the IPv6 address, determine a first mapping table corresponding to the association information of the IPv6 address; the first mapping table includes a correspondence between the IPv6 application service address, the routing prefix, and the AS in multiple reference IPv6 addresses in the association information of the IPv6 address; For each AS among the multiple ASs: if the ratio between the number of routing prefixes corresponding to the AS in the first mapping table and the total number of multiple routing prefixes included in the AS is greater than a preset ratio threshold, it is determined that all IPv6 addresses included in the AS are application service addresses.

2. The method according to claim 1, characterized in that The associated information of the IPv6 address is the domain name resolution log of the DNS; The determining, based on the association information of the IPv6 address, a first mapping table corresponding to the association information of the IPv6 address comprises: Based on the DNS domain name resolution log, perform domain name resolution to obtain a correspondence between multiple reference IPv6 addresses and domain names included in the DNS domain name resolution log; In the routing table corresponding to the domain name, query the routing prefix, AS, and IPv6 address interface type of each of the multiple reference IPv6 addresses; Perform port detection on multiple target IPv6 addresses whose IPv6 address interface type is a preset type, and determine the detection results corresponding to the multiple target IPv6 addresses; the multiple target IPv6 addresses are part or all of the multiple reference IPv6 addresses; Based on the detection result, determining the IPv6 application service address among the multiple target IPv6 addresses; Based on the routing prefix and AS corresponding to the IPv6 application service address, a first mapping table is obtained.

3. The method according to claim 2, characterized in that The step of determining the IPv6 application service address among the multiple target IPv6 addresses based on the detection result includes: For each target IPv6 address in the multiple target IPv6 addresses: If the detection result of the target IPv6 address has a return value, it is determined that the target IPv6 address is an application service address.

4. The method according to claim 1, characterized in that The associated information of the IPv6 address is the domain name resolution log of the DNS and the semantic information corresponding to the multiple ASs in the RIR; the semantic information includes the identification field information and description information of the AS; The determining, based on the association information of the IPv6 address, a first mapping table corresponding to a plurality of reference IPv6 addresses included in the association information of the IPv6 address comprises: Based on the DNS domain name resolution log, a second mapping table of multiple reference IPv6 addresses included in the DNS domain name resolution log is obtained; the second mapping table includes the correspondence between the IPv6 application service address, the routing prefix, and the AS in the multiple reference IPv6 addresses; For each AS in the plurality of ASs: if the identification field information of the AS contains a preset keyword, determine The AS is a reference application service AS; the preset keywords include Internet data center IDC, cloud / cloud computing platform Cloud, content distribution network CDN; The first mapping table is obtained based on the correspondence between the multiple reference application service ASs, the IPv6 application service addresses in the multiple reference IPv6 addresses, and the routing prefixes included in the second mapping table.

5. The method according to claim 1, characterized in that The obtaining, based on the DNS domain name resolution log, a second mapping table of multiple reference IPv6 addresses included in the DNS domain name resolution log includes: Based on the DNS domain name resolution log, perform domain name resolution to obtain a correspondence between multiple reference IPv6 addresses and domain names included in the DNS domain name resolution log; In the routing table corresponding to the domain name, query the routing prefix, AS, and IPv6 address interface type of each of the multiple reference IPv6 addresses; Perform port detection on multiple target IPv6 addresses whose IPv6 address interface type is a preset type, and determine the detection results corresponding to the multiple target IPv6 addresses; the multiple target IPv6 addresses are part or all of the multiple reference IPv6 addresses; Based on the detection result, determining the IPv6 application service address among the multiple target IPv6 addresses; Based on the routing prefix and AS corresponding to the IPv6 application service address, a second mapping table is obtained.

6. The method according to claim 1, characterized in that The association information of the IPv6 address is the multiple active IPv6 addresses; The determining, based on the association information of the IPv6 address, a first mapping table corresponding to a plurality of reference IPv6 addresses included in the association information of the IPv6 address comprises: Query the routing table to obtain the routing prefixes and ASs corresponding to the multiple active IPv6 addresses; Aggregating the multiple active IPv6 addresses based on the routing prefix to obtain the number of active IPv6 addresses corresponding to each routing prefix and at least one active IPv6 address; Based on the number of active IPv6 addresses corresponding to each routing prefix, sorting the routing prefixes corresponding to the multiple active IPv6 addresses to obtain a sorting result; Based on the sorting result, a preset number of multiple reference routing prefixes are selected, and at least one reference IPv6 active address of the multiple reference routing prefixes is generated by using an IPv6 active address generation algorithm; the routing prefix includes the multiple reference routing prefixes; Perform port detection on the multiple IPv6 active addresses and at least one reference IPv6 active address of the multiple reference routing prefixes, and determine detection results corresponding to the multiple IPv6 active addresses and at least one reference IPv6 active address of the multiple reference routing prefixes; Based on the detection result, determine the IPv6 application service address among the multiple IPv6 active addresses and at least one reference IPv6 active address of the multiple reference routing prefixes to obtain a first mapping table.

7. The method according to claim 1, characterized in that The associated information of the IPv6 address is the domain name resolution log of the DNS; The determining, based on the association information of the IPv6 address, a first mapping table corresponding to the association information of the IPv6 address comprises: Based on the DNS domain name resolution log, perform domain name resolution to obtain a correspondence between multiple reference IPv4 addresses and domain names included in the DNS domain name resolution log; the multiple reference IPv4 addresses are IPv4 application service addresses; In the routing table corresponding to the domain name, query the routing prefix, AS, and and the geographical location of the IPv4 address; Query the routing tables corresponding to the ASs of the multiple reference IPv4 addresses to determine all routing prefixes of each AS; For each AS: based on the routing prefixes of each of the multiple reference IPv4 addresses, the AS, and the geographical location of the IPv4 address, determining that the geographical locations of the IPv4 addresses corresponding to all the routing prefixes of the AS are the same, and determining the IPv4 application service address included in the AS; A first mapping table is obtained according to the correspondence between the IPv6 address and the IPv4 address, all routing prefixes of each AS, and the IPv4 application service address included in each AS.

8. An identification device for an IPv6 application service address, characterized in that: The device comprises: A first acquisition module is used to acquire the associated information of the IPv6 address; the associated information of the IPv6 address includes at least one of the following: a domain name resolution log of a DNS, semantic information corresponding to multiple ASs in an RIR, and multiple active IPv6 addresses; A second acquisition module is used to obtain the total number of multiple routing prefixes included in each AS in the multiple ASs; A mapping relationship determination module, configured to determine, based on the association information of the IPv6 address, a first mapping table corresponding to the association information of the IPv6 address; the first mapping table including a correspondence between an IPv6 application service address, a routing prefix, and an AS in a plurality of reference IPv6 addresses in the association information of the IPv6 address; An identification module is used to determine, for each AS among the multiple ASs: if the ratio between the number of routing prefixes corresponding to the AS in the first mapping table and the total number of multiple routing prefixes included in the AS is greater than a preset ratio threshold, then all IPv6 addresses included in the AS are determined to be application service addresses.

9. An electronic device, characterized in that: include: at least one processor, and a memory communicatively connected to the at least one processor, wherein: The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the method according to any one of claims 1 to 7.

10. A storage medium, characterized in that: When the computer program in the storage medium is executed by a processor of an electronic device, the electronic device can execute the method as claimed in any one of claims 1 to 7.

Images