Research On Pattern-based IPv6 Address Scan Detection Algorithm

The Ministry of Industry and Information Technology issued a notice on the implementation of the Action Plan for Promoting the Scale Deployment of the Internet Protocol Version 6(IPv6),which further promoted the development of IPv6,promoted the transformation of the IPv6 infrastructure and strengthened network security.Recent research shows that full-network scanning can help reveal new vulnerabilities,monitor the deployment of mitigation measures,and clarify previously opaque distributed ecosystems.Address scanning technology is an important technology for ensuring the security of Internet communications.However,for IPv6 with massive address space,it is not feasible to use scanning technology to detect all possible addresses.This is true even at current speeds of more than one million probes per second.Aiming at the characteristics of large IPv6 address space and difficult to scan quickly,this paper proposes a mode-based IPv6 address scan detection algorithm.The main work is as follows:(1)Through the investigation of domestic and foreign literature,learn to understand the definition and significance of IPv6,as well as the address classification specification and address configuration mode.(2)Combining the IPv6 address scanning tool,we obtained sample data of380,000 addresses,and statistically sorted the IPv6 address data,summarized and analyzed the IPv6 address feature pattern based on real network data.(3)With the idea of association rules,a pattern-based IPv6 address generation algorithm is proposed.The algorithm can generate an address bit interval based on the high-frequency statistics rule of the data sample,and increase the hit rate of the scan by the serialized address generated by the interval.Experimental results show that the algorithm can generate effective hits in IPv6 environment by combining the IPv6 address scan tool and the real data set.