A heterogeneous graph attention network based IPv6 target generation algorithm for nonseed prefixes

Abstract

Abstract The vast scale and sparse distribution of the IPv6 address space pose considerable challenges to efficient scanning. Current IPv6 target generation algorithms primarily rely on pattern mining of seed addresses to generate target addresses, which risks failing when encountering nonseed prefixes. To address this, researchers have proposed IPv6 target generation algorithms for nonseed prefixes. However, existing approaches suffer from limitations such as single-feature exploitation, inadequate utilization of Whois auxiliary information, and inability to handle missing Whois information, resulting in low target address hit rates and prefix coverage. Therefore, we propose 6HAN, which pioneers the use of a heterogeneous graph attention network to model multi-modal correlations. 6HAN first constructs a heterogeneous graph leveraging IPv6 prefixes and their Whois metadata. Subsequently, 6HAN integrates Whois auxiliary attributes with prefix structural features to generate prefix embeddings and designs a dual-task joint self-supervised framework for model training. Finally, 6HAN completes missing Whois fields through graph neural network-based correlation prediction, retrieves similar seed prefixes for pattern migration to form nonseed prefix address patterns, and generates high-quality IPv6 target addresses. Experimental results demonstrate that when sending 50 million probe packets, 6HAN improves the hit rates by 13.81%-201.05% and prefix coverage by 17.41%-233.58% compared with HMap6 and AddrMiner-N.