[网络领域顶会追踪系列#31][ATC'22]AddrMiner：一个全面的全球活跃IPv6地址发现系统

本系列为个人论文阅读笔记，大多数应该是对顶会摘要的个人菜鸟翻译，旨在让感兴趣的朋友能快速浏览、获取信息。如有错误或心得，欢迎在评论区交流指正！

AddrMiner: A Comprehensive Global Active IPv6 Address Discovery System

作者单位：BNRist，清华大学，泉城实验室，北京交通大学

背景

快速的互联网范围（Internet-wide）扫描对网络态势感知和资产评估十分重要。

挑战

然而，广阔的IPv6地址空间让暴力搜索变得不可行。尽管最先进的技术已经做了有效的尝试，这些方法还是不能在无种子区域（seedless regions）上生效，且探测效率在有种区域上较低。

工作&实验

本文介绍了AddrMiner，一种系统和全面的全球活跃IPv6地址探测系统。作者将IPv6地址空间域根据种子地址的数量分为了三类，以从无到有、从少到多的发现活跃的IPv6地址。

对于没有种子的区域，作者提出AddrMiner-N，使用一个组织相关策略来发掘活跃IP地址。它填充了在无种子域中地址探测的间隔，发现覆盖被BGP宣告的86.4K个IPv6前缀，占被探测前缀的81.6%。

对于种子较少的区域，作者提出AddrMiner-F，利用相似的匹配策略来进一步探测活跃的IP地址。活跃IP地址探测的命中率相较于现有的算法，提升了70%~150%。

对于充足种子的区域，作者提出了AddrMiner-S来基于强化学习动态地产生目标地址。它相比于最先进的算法几乎提升了一倍的命中率。

最后，作者部署了AddrMiner并且通过持续13个月的探测，发现了2.1亿个活跃的IPv6地址，包括1.7亿个去别名（de-aliased）的活跃地址和0.5亿个别名地址。作者想要通过发布AddrMiner且共享他们的数据，来为公众进一步开启IPv6测量研究的大门。

原文摘要

Fast Internet-wide scanning is essential for network situational awareness and asset evaluation. However, the vast IPv6 address space makes brute-force scanning infeasible. Although state-of-the-art techniques have made effective attempts, these methods do not work in seedless regions, while the detection efficiency is low in regions with seeds. Moreover, the constructed hitlists with low coverage cannot truly represent the active IPv6 address landscape of the Internet.

This paper introduces AddrMiner, a global active IPv6 address probing system, making IPv6 active address probing systematic, comprehensive, and economical. We divide the IPv6 address space regions into three kinds according to the number of seed addresses and propose a probing algorithm for each of them. For the regions with no seeds, we propose AddrMiner-N, leveraging an organization association strategy to mine active addresses. It finds active addresses covering 86.4K BGP prefixes, accounting for 81.6\% of the probed BGP prefixes. For the regions with few seeds, we propose AddrMiner-F, utilizing a similarity matching strategy to probe active addresses further. The hit rate of active address probing is improved by 70\%-150\% compared to existing algorithms. For the regions with sufficient seeds, we propose AddrMiner-S to generate target addresses based on reinforcement learning dynamically. It nearly doubles the hit rate compared to the state-of-the-art algorithms. Finally, we deploy AddrMiner and discover 2.1 billion active IPv6 addresses, including 1.7 billion de-aliased active addresses and 0.4 billion aliased addresses, through continuous probing for 13 months. We would like to further open the door of IPv6 measurement studies by publicly releasing AddrMiner and sharing our data.