IMR: MM-1C: Methods and Metrics for IPv6 Internet Scanning

Georgia Tech Research Corporation, Atlanta GA

Investigators

Abstract

Technology to quickly map (i.e., scan) the Internet and explore its characteristics is of the utmost importance to researchers, governments, policy makers and businesses. Existing technologies rely on exhaustively enumerating the entire Internet address space. With the advent and recent widespread adoption of a newer Internet addressing scheme (called IPv6), such exhaustive enumeration is impossible, preventing our existing technology from being applied to future Internet growth. This project will create new Internet mapping technologies that are suitable for the newer IPv6 addressing scheme through the careful exploration of how IPv6 is deployed in practice, the development and evaluation of key mapping metrics, and the use of reinforcement learning on known addresses. This project will enable the next generation of generative IPv6 Internet scanning, and provide a platform for extending existing IPv4 research to the IPv6 realm. Developing IPv6 scanning metrics and methods requires understanding detailed behaviors of the IPv6 protocol, service providers, address allocation, and machine-learning methods. The project will first construct a set of comprehensive metrics for understanding IPv6 scanning performance that can serve as a benchmark for evaluating current and future scanning techniques. Next the project will characterize the substantial impact of large-scale IPv6 aliasing on IPv6 scanning, and the inadequacy of prior solutions, especially in the context of existing metrics and methods. From this the project will develop an online IPv6 dealiasing strategy and evaluate it over existing methods, quantifying its improvement on IPv6 Internet scanning. Lastly, guided by the aforementioned metrics and understanding of aliasing, the project will develop a new generalized online approach to IPv6 address generation and scanning via levering reinforcement learning from a set of known seed addresses to generate a diverse set of candidate IPv6 addresses which it subsequently scans. Extending whole-Internet scanning to IPv6 is critical to a range of networking topics, from censorship measurement to network outages to vulnerability detection. Further, it is necessary to ensure results do not bias against certain regions without significant IPv4 infrastructure. Thus the value of IPv6 measurement and Internet scanning as a whole is key to researchers, policymakers, and governments. This project will produce the foundation for supporting a wide range of IPv6 Internet measurement research in the future. More information about the project, including all research papers, datasets, code, repositories, tools, results, and outreach activities can be found on the project's website: https://cc.gatech.edu/~pearce/imr_metrics_methods_ipv6/. The website will be maintained for a period of at least 5 years after completion of the project. This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.