6Vision: Image-encoding-based IPv6 Target Generation in Few-seed Scenarios

TL;DR

This work tackles the challenge of IPv6 target generation in few-seed scenarios, where seed sampling bias and complex configuration rules impede existing methods. It proposes 6Vision, an image-encoding framework that converts IPv6 addresses into 8x16 images, clusters them by learned features, stitches image features to expand learnable space, and uses an autoregressive Gated PixelCNN with an environment feedback loop to generate high-probability targets. The approach achieves substantial improvements in HitRate (approximately 181% to 2490% over baselines) and CoverNum (1.18 to 11.20x), and provides a conversion gain up to 2081% when used as a preliminary detector for existing methods, with a reported conversion rate of 28.97% for few-seed scenarios. Additionally, it introduces the IPv6 hitlist Patch dataset (5.67M addresses across 47,773 prefixes) and demonstrates that 6Vision can both enrich hitlists and serve as a practical step toward more effective IPv6 network measurement and security analysis.

Abstract

Efficient global Internet scanning is crucial for network measurement and security analysis. While existing target generation algorithms demonstrate remarkable performance in large-scale detection, their efficiency notably diminishes in few-seed scenarios. This decline is primarily attributed to the intricate configuration rules and sampling bias of seed addresses. Moreover, instances where BGP prefixes have few seed addresses are widespread, constituting 63.65% of occurrences. We introduce 6Vision as a solution to tackle this challenge by introducing a novel approach of encoding IPv6 addresses into images, facilitating comprehensive analysis of intricate configuration rules. Through a process of feature stitching, 6Vision not only improves the learnable features but also amalgamates addresses associated with configuration patterns for enhanced learning. Moreover, it integrates an environmental feedback mechanism to refine model parameters based on identified active addresses, thereby alleviating the sampling bias inherent in seed addresses. As a result, 6Vision achieves high-accuracy detection even in few-seed scenarios. The HitRate of 6Vision shows a significant improvement ranging from 181% to 2,490% compared to existing algorithms, while the CoverNum increases by a factor of 1.18 to 11.20 times. Additionally, 6Vision can function as a preliminary detection module for existing algorithms, yielding a conversion gain (CG) ranging from 242% to 2,081%. Ultimately, we achieve a conversion rate (CR) of 28.97% for few-seed scenarios. We develop the IPv6 hitlist Patch, which augments current target generation algorithms for large-scale address detection, thereby effectively supporting IPv6 network measurement and security analysis.

Figures (8)

• Figure 1: The overview of 6Vision and its key technical components.
• Figure 2: The image encoding of the IPv6 address set.
• Figure 3: The definition of CG.
• Figure 4: $HitRate$
• Figure 5: CoverNum