6Scan: A High-Efficiency Dynamic Internet-Wide IPv6 Scanner With Regional Encoding

• Published in: IEEE/ACM transactions on networking Vol. 31; no. 4; pp. 1 - 16
• Main Authors: Hou, Bingnan, Cai, Zhiping, Wu, Kui, Yang, Tao, Zhou, Tongqing
• Format: Journal Article
• Language: English
• Published: New York IEEE 01.08.2023; The Institute of Electrical and Electronics Engineers, Inc. (IEEE)
• Subjects: alias prefix resolution; Coding; Cybersecurity; Encoding; Heuristic algorithms; Internet; internet-wide scanning; IP (Internet Protocol); IP networks; IPv6; network measurement; Reinforcement learning; Scanners; Search algorithms; Search problems; Topology
• ISSN: 1063-6692; 1558-2566
• DOI: 10.1109/TNET.2023.3233953

Efficient Internet-wide scanning plays a vital role in network measurement and cybersecurity analysis. While Internet-wide IPv4 scanning is a solved problem, Internet-wide scanning for IPv6 is still a mission yet to be accomplished due to its vast address space. To tackle this challenge, IPv6 scanning generally needs to use pre-defined seed addresses to guide further IPv6 scanning directions. Under this general principle, various solutions have been developed, but all suffer from two primary pitfalls, low hit rate and low probing speed, caused by the inherent sparse distribution of active IPv6 addresses and the high computational complexity of the search algorithms, respectively. We develop 6Scan, a novel asynchronous IPv6 scanner that effectively addresses the above two problems. To increase the hit rate, 6Scan infers the promising search directions by encoding the regional identifiers of the target addresses within the probing packets and recording the regional activities from the asynchronously arrived replies. It then dynamically adjusts the search directions according to the scanning result of the previous steps. To speed up the search algorithm, 6Scan leverages the regional identifier encoding to quickly adjust search direction without excessive computation. Real-world experiments over the IPv6 Internet in a billion-scale probing budget show that compared with the state-of-the-art solutions, on average 6Scan can discover <inline-formula> <tex-math notation="LaTeX">6\%</tex-math> </inline-formula> more active addresses with nearly the same scanning time.