AddrMiner: A Fast, Efficient, and Comprehensive Global Active IPv6 Address Detection System
Guanglei Song,Lin He,Feiyu Zhu,Jinlei Lin,Wenjian Zhang,Linna Fan,Chenglong Li,Zhiliang Wang,Jiahai Yang
DOI: https://doi.org/10.1109/tnet.2024.3406508
2024-01-01
Abstract:Fast Internet-wide scanning is essential for network situational awareness and asset evaluation. However, the vast IPv6 address space makes brute-force scanning infeasible. Despite advancements in state-of-the-art methods, they do not work in seedless regions and suffer low detection efficiency and speed in regions with known active IPv6 addresses (i.e., seed addresses). Moreover, the collected active address list (i.e., IPv6 hitlist) with low coverage cannot truly represent the active IPv6 address landscape of the Internet. This paper introduces, a fast, efficient, and comprehensive global active IPv6 address detection system. We design a systematic active IPv6 address detection strategy that divides the IPv6 space into two detection scenarios based on the presence or absence of seed addresses to discover active IPv6 addresses from scratch and from few to many. In the seedless regions, we present, leveraging a multi-level association policy to probe active addresses. It fills the gap of address detection in seedless regions and successfully discovers active addresses in 39,899 BGP prefixes without seed addresses, with a 1.03 x higher hit rate, 30 similar to 911 x higher speed, and 2.7 x broader coverage, compared to existing solutions. In the regions with seed addresses, our method dynamically generates target addresses using reinforcement learning. Compared to state-of-the-art methods, achieves an impressive 56.3% hit rate and a discovery speed of 839.0/s, which is 1.9 similar to 2153 x and 1.5 similar to 755 x of existing works, respectively. Finally, we deploy and discover 2.1B active IPv6 addresses, including 1.7B de-aliased active addresses and 0.4B aliased addresses, through continuous probing for three years.