CN116389416A

CN116389416A - Massive IPv6 address identification method, system, electronic equipment and storage medium

Info

Publication number: CN116389416A
Application number: CN202111494912.5A
Authority: CN
Inventors: 黄友俊; 李星; 吴建平; 黄有根; 邓斌
Original assignee: CERNET Corp
Current assignee: CERNET Corp
Priority date: 2021-12-08
Filing date: 2021-12-08
Publication date: 2023-07-04

Abstract

The present disclosure provides a method for identifying massive IPv6 addresses, including: s1, acquiring an IPv6 data stream, and acquiring a first address set with non-zero flow from the IPv6 data stream; s2, sequencing the number of the values of the fixed fields in the first address set to obtain N values with the largest number; s3, respectively replacing the values with the maximum N numbers into fixed fields in the first address set to obtain N groups of second address sets; and S4, carrying out address survival identification on the N groups of second address sets to obtain the survival IPv6 address. According to the mass IPv6 address identification method, system, electronic equipment and storage medium, according to the IPv6 characteristics, the number of the values of the fixed fields in the first address set is ordered, the values with the largest number N are respectively replaced into the fixed fields in the first address set, a new IPv6 address set is formed, so that the number of IPv6 active users in any area can be counted more rapidly, and the accuracy and the effectiveness of IP resource management are improved.

Description

Massive IPv6 address identification method, system, electronic equipment and storage medium

Technical Field

The disclosure relates to the field of communication, in particular to a method, a system, electronic equipment and a storage medium for identifying massive IPv6 addresses.

Background

The industrial and informative sector issues 2021 work arrangement (hereinafter referred to as notification) for deep-advanced IPv6 scale deployment and application, month 6 of 2021. The notification clearly shows that by the end of 2021, the network bearing capacity is obviously enhanced, and the key index of the IPv6 network is not inferior to IPv4 by the end of 2021. The IPv6 transformation is basically completed by application infrastructures such as a data center, a content distribution network, a cloud platform, a domain name resolution system and the like. The newly marketed home wireless router supports and defaults to turn on IPv6 functionality. More than 30 IPv6 technical innovations and fusion application test point items are deployed. The number of IPv6 active users reaches 5.5 hundred million, and the number of IPv6 connections of the Internet of things reaches 5000 ten thousand. The IPv6 traffic ratio of the mobile network reaches 20%, and the IPv6 traffic ratio of the metropolitan area network reaches 5%. The IPv6 supporting rate of government portal sites above county level reaches 70%, and the IPv6 supporting rate of domestic main commercial websites and mobile Internet application reaches 60%. It is imperative to identify available assets for IPv 6.

Disclosure of Invention

Aiming at the defects existing in the prior art, the invention provides a method, a system, electronic equipment and a storage medium for identifying massive IPv6 addresses, which can rapidly count the number of IPv6 active users in any area.

The invention provides a method for identifying massive IPv6 addresses, which comprises the following steps: s1, acquiring an IPv6 data stream, and acquiring a first address set with non-zero flow from the IPv6 data stream; s2, sequencing the number of the values of the fixed fields in the first address set to obtain N values with the largest number; s3, respectively replacing the values with the maximum N numbers into fixed fields in the first address set to obtain N groups of second address sets; and S4, carrying out address survival identification on the N groups of second address sets to obtain the survival IPv6 address.

Optionally, the IPv6 data flow collected in step S1 originates from a router or a switch; the method for collecting IPv6 data flow comprises the following steps: configuring a flow analysis tool Netflow on a router or a switch, starting the flow analysis tool Netflow, and collecting the IPv6 data flow; the acquired IPv6 data flow includes: source IP, destination IP, ingress traffic and egress traffic.

Optionally, the fixed field is the last 16 bits of the IPv6 address.

Optionally, N is 10.

Optionally, asset detection is performed on the surviving IPv6 address, which includes: s101, acquiring an asset detection task; s102, extracting a scanning type and a detection strategy corresponding to the scanning type which are included in an asset detection task; s103, identifying the surviving assets based on the scanning type and the detection strategy.

Optionally, the method further comprises identifying the surviving IPv6 address so as to facilitate subsequent reading of the IPv6 address information and classifying according to the address information.

Optionally, the identifying the surviving IPv6 address includes identifying a country, province and city, organization, AS number and purpose to which the IPv6 address belongs, so AS to facilitate subsequent reading of the address information of the IPv6 address, and classifying according to the address information.

The invention also provides a massive IPv6 address identification system, which comprises: the acquisition module is used for acquiring the identification information of the IPv6 data stream and the address thereof; a first extraction module, configured to obtain a first address set with a flow that is non-zero from the IPv6 data flow; the analysis module is used for sequencing the number of the values of the fixed fields in the first address set and obtaining N values with the largest number; the integration module is used for respectively replacing the N values with the largest quantity into fixed fields in the first address set to obtain N groups of second address sets; the second extraction module is used for carrying out address survival identification on the N groups of second address sets and extracting the surviving IPv6 addresses; the acquisition module, the first extraction module, the analysis module, the integration module and the second extraction module are sequentially connected.

The invention also provides a computer readable storage medium storing computer executable instructions which, when executed, are adapted to carry out the method of any one of claims 1 to 5.

The invention also provides an electronic device, comprising: one or more processors; a memory for storing one or more programs, wherein the one or more programs, when executed by the one or more processors, cause the one or more processors to implement the method of any of claims 1-5.

According to the method, the system, the electronic equipment and the storage medium for identifying the massive IPv6 addresses, disclosed by the invention, according to the IPv6 characteristics, the number of the values of the fixed fields in the first address set is sequenced, and the values with the largest N numbers are respectively replaced into the fixed fields in the first address set to form a new IPv6 address set, so that the number of the IPv6 active users in any area can be counted more rapidly, and the accuracy and the effectiveness of IP resource management are improved.

Drawings

FIG. 1 schematically illustrates a flow chart of a method of massive IPv6 address identification according to an embodiment of the present disclosure;

FIG. 2 schematically illustrates a block diagram of a massive IPv6 address identification system according to an embodiment of the present disclosure;

fig. 3 schematically illustrates a structural schematic diagram of an electronic device according to an embodiment of the present disclosure;

in the figure, the acquisition module-410, the first extraction module-420, the analysis module-430, the integration module-440, the second extraction module-450, the processor-510, the memory-520 and the program-521 are provided.

Detailed Description

Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. It should be understood that the description is only exemplary and is not intended to limit the scope of the present disclosure. In the following detailed description, for purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the embodiments of the present disclosure. It may be evident, however, that one or more embodiments may be practiced without these specific details. In addition, in the following description, descriptions of well-known structures and techniques are omitted so as not to unnecessarily obscure the concepts of the present disclosure.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. The terms "comprises," "comprising," and/or the like, as used herein, specify the presence of stated features, steps, operations, and/or components, but do not preclude the presence or addition of one or more other features, steps, operations, or components.

Fig. 1 schematically illustrates a flow chart of a method of massive IPv6 address identification according to an embodiment of the present disclosure.

The embodiment of the disclosure provides a method for identifying massive IPv6 addresses, as shown in fig. 1, comprising the following steps:

s1, acquiring an IPv6 data stream, and acquiring a first address set with non-zero flow from the IPv6 data stream;

in the above step S1, the collected IPv6 data flow originates from a router or a switch.

The method for collecting IPv6 data flow comprises the following steps: configuring a flow analysis tool Netflow on a router or a switch; and starting a flow analysis tool Netflow, and collecting the IPv6 data flow.

The acquired IPv6 data flow includes: source IP, destination IP, ingress traffic and egress traffic. The source IP is the source IP of the data stream, and the destination IP receives the IP of the data party. The output flow refers to the flow of the data packet sent by the equipment or the website and the like corresponding to the IPv6 address; the ingress flow is the flow of the data packet corresponding to the device or the website corresponding to the IPv6 address, which is sent when responding, and the ingress flow is only used for condition judgment and is not counted in the IPv6 address set.

And eliminating IPv6 addresses with zero outgoing traffic or incoming traffic, and finishing the rest IPv6 addresses into a first address set.

The remaining address numbers are counted after the address set with the flow of 0 is removed, and the ratio statistics of the remaining address numbers are as follows:

	total number of IP	Total number of active addresses	Active duty cycle (%)
				Measurement 1	1165618636	237088168	20.34％
Measurement 2	1100157381	210645387	19.15％
				Measurement 3	958901876	194882062	20.32％

As shown in the table above, the first address set in measurement 1 is the total number of active addresses 237088168, the first address set in measurement 2 is the total number of active addresses 210645387, and the first address set in measurement 3 is the total number of active addresses 194882062.

S2, sequencing the number of the values of the fixed fields in the first address set to obtain N values with the largest number;

wherein the fixed field is the last 16 bits of the IPv6 address, and ordering the number of values of the fixed field in the first address set includes: counting probability distribution conditions of 16 bits after IPv6 addresses in a first address set, and selecting the 16 bits after the IPv6 addresses with probability of N items before ranking; since the IPv6 address binary representation has 128 bits, the next 16 bits are: 0000 0000 0000 0000 to 1111 1111 1111 1111, expressed in 16: 0000-ffff.

The probability distribution of 16 bits after IPv6 is counted as follows:

s3, replacing the values of the fixed fields of the M IPv6 addresses in the first address set with the values of the fixed fields of the IPv6 addresses of the N items with probability duty ratios, forming M.times.N IPv6 addresses, and finishing the M.times.N IPv6 addresses into a second address set.

Wherein N is 10. That is, the probability duty cycle should be 16 bits after the IPv6 address of the top N terms: 0000;0002;0001;0006;0003;0004;0020;0009;0010;0008.

suppose that the first address set includes 2001: da8:6030:3: :2 and 2001: da8:6026: :1 two IPv6 addresses, then "0000" will be used; 0002;0001;0006;0003;0004;0020;0009;0010;0008 "substitution 2001: da8:6030:3: : the last 16 bits in 2, get the first set of addresses:

2001：da8：6030：3：：

2001：da8：6030：3：：2

2001：da8：6030：3：：1

2001：da8：6030：3：：6

2001：da8：6030：3：：3

2001：da8：6030：3：：4

2001：da8：6030：3：：20

2001：da8：6030：3：：5

2001：da8：6030：3：：9

2001：da8：6030：3：：10

"0000;0002;0001;0006;0003;0004;0020;0009;0010;0008 "substitution 2001: da8:6026: : the last 16 bits in 1, a second set of addresses:

2001：da8：6026：：

2001：da8：6026：：2

2001：da8：6026：：1

2001：da8：6026：：6

2001：da8：6026：：3

2001：da8：6026：：4

2001：da8：6026：：20

2001：da8：6026：：5

2001：da8：6026：：9

2001：da8：6026：：10

in summary, the second address set should include the following IPv6 addresses:

2001：da8：6030：3：：

2001：da8：6030：3：：2

2001：da8：6030：3：：1

2001：da8：6030：3：：6

2001：da8：6030：3：：3

2001：da8：6030：3：：4

2001：da8：6030：3：：20

2001：da8：6030：3：：5

2001：da8：6030：3：：9

2001：da8：6030：3：：10

2001：da8：6026：：

2001：da8：6026：：2

2001：da8：6026：：1

2001：da8：6026：：6

2001：da8：6026：：3

2001：da8：6026：：4

2001：da8：6026：：20

2001：da8：6026：：5

2001：da8：6026：：9

2001：da8：6026：：10

and S4, performing address survival identification on the second address set to obtain a survived IPv6 address.

Comprising the following steps: and judging whether the IPv6 addresses in the second address set survive or not through a detection tool nmap.

That is, filtering the IPv6 address by the detection tool, and filtering the non-surviving IPv6 address. The detection tool nmap is a Network Mapper. The basic functions are three, namely detecting whether a group of hosts are online; secondly, scanning a host port and sniffing the provided network service; the operation system used by the host can also be inferred, whether the IPv6 address survives or not can be detected by the operation system, the ping scanning can be performed, the host responding to the scanning is printed out, and the like, and the detection tool nmap is used in the prior art and is not described in detail herein. In addition, the embodiment of the application does not limit the tools for detecting whether the IPv6 address survives, and only needs to judge the survival of the IPv6 address.

Then, the first set of number test results are as follows:

IPv6 address	Whether or not to survive
		2001：da8：6030：3：：	Whether or not
2001：da8：6030：3：：2	Is that
		2001：da8：6030：3：：1	Is that
2001：da8：6030：3：：6	Whether or not
		2001：da8：6030：3：：3	Whether or not
2001：da8：6030：3：：4	Is that
		2001：da8：6030：3：：20	Whether or not
2001：da8：6030：3：：5	Whether or not
		2001：da8：6030：3：：9	Whether or not
2001：da8：6030：3：：10	Whether or not

The second set of number test results are as follows:

IPv6 address	Whether or not to survive
		2001：da8：6026：：	Whether or not
2001：da8：6026：：2	Is that
		2001：da8：6026：：1	Is that
2001：da8：6026：：6	Whether or not
		2001：da8：6026：：3	Is that
2001：da8：6026：：4	Whether or not
		2001：da8：6026：：20	Whether or not
2001：da8：6026：：5	Whether or not
		2001：da8：6026：：9	Whether or not
2001：da8：6026：：10	Whether or not

According to the test method, hit rate of 30% exists in each detection, IPv6 is quickly identified and survived according to probability distribution, and the problems that IPv6 addresses are huge and quick identification is difficult are solved.

S5, performing asset detection on the surviving IPv6, wherein the asset detection method comprises the following steps of:

s101, acquiring an asset detection task.

The asset detection task is created within a detection range, which may be the local area network range of the enterprise, the network range where each device set in the factory is located, etc. The assets include all devices of computers, routers, printers, etc. that access the network. The asset detection tasks may be pre-established, e.g., periodically performing asset detection, etc.; it may also be established in real time, for example, immediately upon a user's need to know current asset information, etc.

S102, extracting a scanning type and a detection strategy corresponding to the scanning type, which are included in the asset detection task.

The asset detection task at least includes a scanning type, a scanning time, a scanning packet sending speed, and an asset detection result storage path, and of course, other task information may also be included, which is not limited in detail in the embodiment of the present disclosure. It should be noted that each probe information in the asset detection task may be customized.

The scanning type can indicate a detection survival address, and the asset detection task further comprises a detection network segment; the scan type may also indicate that surviving hosts and surviving ports are detected, where the asset detection task further includes a detection network segment and a port range; the scan type may also indicate that surviving addresses, surviving ports, and service fingerprints are detected, where the asset detection task also includes detection network segments, port ranges, and service fingerprints.

Since the scan type indicates one or more of a probe surviving address, a surviving port, and a service fingerprint, its corresponding probe policy may be set based on different scan types and included in the asset probe task in association with the scan type, thereby enabling the surviving asset to be identified based on the scan type and the probe policy corresponding to the scan type after the asset probe task is acquired.

S103, identifying the surviving assets based on the scanning type and the detection strategy.

After extracting the scan type and the detection policy, surviving assets are identified based on the scan type and the detection policy. Where a surviving asset refers to a device in operation among all devices accessing the network.

The embodiment of the disclosure can customize the scanning type, further complete the identification of the surviving asset according to the detection strategy corresponding to the scanning type included in the asset detection task, solve the problem of limited detection range, and be suitable for asset detection under various business scenes; meanwhile, by detecting one or more of the surviving host, the surviving port and the service fingerprint, the accuracy of the detection result is improved.

In the case where the scan type indicates a probe surviving host, S103 includes: and sending a first detection message to an IP address in a detection network segment contained in the detection strategy, determining that the host corresponding to the IP address responding to the first detection message is a surviving host, and then determining that the asset to which the surviving host belongs is a surviving asset.

In the case where the scan type indicates to probe the surviving host and the surviving port, S103 includes: sending a first detection message to an IP address in a detection network segment contained in the detection strategy; determining that the host corresponding to the IP address responding to the first detection message is a surviving host; sending a second detection message to a port corresponding to the surviving host and in a port range, wherein the detection strategy comprises the port range; determining the port responding to the second detection message as a survival port; and determining the asset to which the survival port belongs as a survival asset.

S6, identifying the surviving IPv6, including identifying the country, province and city, organization, AS number and purpose (open port service) of the IPv6 address, and displaying part of data AS follows:

by doing so, the address information of IPv6 can be conveniently read later, and classification can be carried out according to the address information.

Fig. 2 schematically illustrates a structural diagram of a massive IPv6 address identification system according to an embodiment of the present disclosure.

A massive IPv6 address identification system, as shown in fig. 2, comprising:

the acquisition module 410 is configured to acquire identification information of an IPv6 data stream and an address thereof;

a first extracting module 420, configured to obtain a first address set with a non-zero flow from the IPv6 data flow;

an analysis module 430, configured to sort the number of values of the fixed field in the first address set, and obtain N values with the largest number;

the integration module 440 is configured to replace the N most numerous values into fixed fields in the first address set, to obtain N groups of second address sets;

a second extracting module 450, configured to perform address survival identification on the N groups of second address sets, and extract a surviving IPv6 address;

the collection module 410, the first extraction module 420, the analysis module 430, the integration module 440, and the second extraction module 450 are sequentially connected.

A computer readable storage medium storing computer executable instructions which when executed are adapted to implement a method of identifying a massive IPv6 address as described above.

The computer-readable storage medium may be included in the apparatus/device/system described in the above embodiments or may exist alone without being assembled into the apparatus/device/system. The computer-readable storage medium carries one or more programs which, when executed, implement methods in accordance with embodiments of the present invention.

Fig. 3 schematically illustrates a structural schematic diagram of an electronic device according to an embodiment of the present disclosure.

An electronic device, comprising: one or more processors 510; and a memory 520 for storing one or more programs 521, wherein the one or more programs 521, when executed by the one or more processors 510, cause the one or more processors 510 to implement a method for identifying a massive IPv6 address.

The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present invention. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or flowchart illustration, and combinations of blocks in the block diagrams or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

While the foregoing is directed to embodiments of the present invention, other and further details of the invention may be had by the present invention, it should be understood that the foregoing description is merely illustrative of the present invention and that no limitations are intended to the scope of the invention, except insofar as modifications, equivalents, improvements or modifications are within the spirit and principles of the invention.

Claims

1. The method for identifying the massive IPv6 addresses is characterized by comprising the following steps of:

s3, respectively replacing the values with the maximum N numbers into fixed fields in the first address set to obtain N groups of second address sets;

and S4, carrying out address survival identification on the N groups of second address sets to obtain the survival IPv6 address.

2. The method for identifying massive IPv6 addresses according to claim 1, wherein the IPv6 data flow collected in step S1 originates from a router or a switch; the method for collecting IPv6 data flow comprises the following steps: configuring a flow analysis tool Netflow on a router or a switch, starting the flow analysis tool Netflow, and collecting the IPv6 data flow; the acquired IPv6 data flow includes: source IP, destination IP, ingress traffic and egress traffic.

3. The method of claim 1, wherein the fixed field is the last 16 bits of the IPv6 address.

4. The method for identifying massive IPv6 addresses according to claim 1, wherein N is 10.

5. The method of mass IPv6 address identification of claim 1, further comprising asset exploration of the surviving IPv6 addresses, comprising:

s101, acquiring an asset detection task;

s102, extracting a scanning type and a detection strategy corresponding to the scanning type which are included in an asset detection task;

6. The method of claim 1, further comprising identifying the surviving IPv6 addresses to facilitate subsequent reading of IPv6 address information and classifying according to the address information.

7. The method of claim 6, wherein identifying surviving IPv6 addresses includes identifying the country, province, city, organization, AS number, and use to which the IPv6 addresses belong to facilitate subsequent reading of the IPv6 address information and classification according to the address information.

8. A massive IPv6 address identification system, comprising:

the acquisition module (410) is used for acquiring the identification information of the IPv6 data stream and the address thereof;

a first extraction module (420) configured to obtain a first address set with a non-zero traffic from the IPv6 data flow;

an analysis module (430) configured to sort the number of values of the fixed fields in the first address set, and obtain N values with the largest number;

an integration module (440) for replacing the N most numerous values into fixed fields in the first address set, respectively, to obtain N groups of second address sets;

a second extracting module (450) for performing address survival identification on the N groups of second address sets, and extracting surviving IPv6 addresses;

the acquisition module (410), the first extraction module (420), the analysis module (430), the integration module (440) and the second extraction module (450) are sequentially connected.

9. A computer readable storage medium, characterized in that computer executable instructions are stored, which instructions, when executed, are for implementing the method of any of claims 1 to 5.

10. An electronic device, comprising:

one or more processors (510);

a memory (520) for storing one or more programs (521),

wherein the one or more programs (521), when executed by the one or more processors (510), cause the one or more processors (510) to implement the method of any of claims 1-5.