6Vision: Image-encoding-based IPv6 Target Generation in Few-seed Scenarios

TL;DR

6Vision introduces an innovative image-encoding approach for IPv6 address generation, significantly improving detection accuracy in few-seed scenarios and enhancing large-scale Internet scanning efficiency.

Contribution

The paper presents a novel image-encoding method for IPv6 addresses, incorporating feature stitching and environmental feedback to address seed bias and improve detection in scarce-seed scenarios.

Findings

HitRate improved by 181% to 2490% over existing algorithms.

CoverNum increased by 1.18 to 11.20 times.

Conversion gain (CG) ranged from 242% to 2081%.

Abstract

Efficient global Internet scanning is crucial for network measurement and security analysis. While existing target generation algorithms demonstrate remarkable performance in large-scale detection, their efficiency notably diminishes in few-seed scenarios. This decline is primarily attributed to the intricate configuration rules and sampling bias of seed addresses. Moreover, instances where BGP prefixes have few seed addresses are widespread, constituting 63.65% of occurrences. We introduce 6Vision as a solution to tackle this challenge by introducing a novel approach of encoding IPv6 addresses into images, facilitating comprehensive analysis of intricate configuration rules. Through a process of feature stitching, 6Vision not only improves the learnable features but also amalgamates addresses associated with configuration patterns for enhanced learning. Moreover, it integrates an environmental feedback mechanism to refine model parameters based on identified active addresses, thereby alleviating the sampling bias inherent in seed addresses. As a result, 6Vision achieves high-accuracy detection even in few-seed scenarios. The HitRate of 6Vision shows a significant improvement ranging from 181% to 2,490% compared to existing algorithms, while the CoverNum increases by a factor of 1.18 to 11.20 times. Additionally, 6Vision can function as a preliminary detection module for existing algorithms, yielding a conversion gain (CG) ranging from 242% to 2,081%. Ultimately, we achieve a conversion rate (CR) of 28.97% for few-seed scenarios. We develop the IPv6 hitlist Patch, which augments current target generation algorithms for large-scale address detection, thereby effectively supporting IPv6 network measurement and security analysis.