6RLD: A Seedless Region Active IPv6 Address Dynamic Detection Method Based on Large Language Model and RAG Technology
摘要
In large-scale IPv6 network space mapping, accurately and efficiently obtaining a set of active IPv6 addresses is essential for subsequent network asset and topology measurement. Given the vast IPv6 address space, recent research on active IPv6 address detection has primarily focused on regions with known active IPv6 addresses (seeded regions), while over 65% of IPv6 prefixes lacking seed addresses (seedless regions) have been largely overlooked. To uncover active IPv6 addresses in these seedless regions, this paper introduces 6RLD, an IPv6 address generation and detection solution leveraging large language models and RAG technology. Firstly, a universal address pattern library is constructed characterized by transferability, low noise, and high coverage. This is achieved by integrating multidimensional joint entropy hierarchical clustering with isolated forest algorithms and dynamic IQR box plot-based anomaly detection methods. Secondly, utilizing RAG technology and the LLaMA-3 model, cross-organizational semantic reasoning and pattern transfer are implemented within a vector database. This precisely maps the allocation strategies between the pattern library and seedless prefixes, generating prioritized candidate patterns. Finally, a parallel dynamic detection mechanism based on the multi-armed bandit model is designed to optimize resource allocation in practical detection scenarios. Experimental results demonstrate that 6RLD outperforms existing advanced methods both in hit rate and coverage. Under a detection budget of 1M and at scale, compared to the state-of-the-art AddrMiner-N, 6RLD increases the hit rate from 4.2% to 5.2% – a 23.81% relative improvement, equivalent to discovering 10,000 additional valid addresses per prefix.