{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,20]],"date-time":"2026-06-20T12:52:33Z","timestamp":1781959953504,"version":"3.54.5"},"reference-count":35,"publisher":"Oxford University Press (OUP)","issue":"6","license":[{"start":{"date-parts":[[2026,2,23]],"date-time":"2026-02-23T00:00:00Z","timestamp":1771804800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/academic.oup.com\/pages\/standard-publication-reuse-rights"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62472434"],"award-info":[{"award-number":["62472434"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62172155"],"award-info":[{"award-number":["62172155"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,6,20]]},"abstract":"<jats:title>Abstract<\/jats:title>\n                  <jats:p>The pervasive interconnection of heterogeneous routing devices forms the fundamental infrastructure of modern Internet communication, making accurate router vendor identification a critical capability for multiple domains including network topology mapping, intelligent traffic engineering, and proactive cybersecurity defense. While Internet Protocol version 6 (IPv6) has achieved widespread global deployment as the next-generation Internet protocol, the opaque nature of its addressing mechanisms and protocol behaviors has created significant challenges in router attribute detection across IPv6 networks, leaving a crucial gap in network visibility and security analytics. To address this pressing challenge, we present IPv6 Router FingerPrinting (6RFP), an innovative lightweight fingerprinting methodology that establishes a new paradigm for IPv6 router vendor identification by systematically combining two complementary analytical dimensions: (i) comprehensive EUI-64 interface identifier analysis that captures vendor-specific hardware encoding patterns embedded in IPv6 addresses, and (ii) sophisticated IPv6 Identification Field characteristic profiling that reveals distinctive vendor implementations. Through extensive evaluation across diverse network environments, 6RFP demonstrates highly effective detection capabilities, achieving 85.79% accuracy\u2014representing a remarkable 86.01% improvement over current state-of-the-art techniques\u2014while maintaining minimal computational overhead suitable for real-time deployment.<\/jats:p>","DOI":"10.1093\/comjnl\/bxag004","type":"journal-article","created":{"date-parts":[[2026,2,12]],"date-time":"2026-02-12T12:45:28Z","timestamp":1770900328000},"page":"963-974","source":"Crossref","is-referenced-by-count":0,"title":["Efficient router fingerprinting in IPv6 networks"],"prefix":"10.1093","volume":"69","author":[{"given":"Yifan","family":"Yang","sequence":"first","affiliation":[{"name":"College of Computer Science and Technology , National University of Defense Technology, 137 Yanwachi Road, Changsha, Hunan 410073,","place":["China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ling","family":"Hu","sequence":"additional","affiliation":[{"name":"College of Computer Science and Technology , National University of Defense Technology, 137 Yanwachi Road, Changsha, Hunan 410073,","place":["China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tao","family":"Yang","sequence":"additional","affiliation":[{"name":"College of Computer Science and Technology , National University of Defense Technology, 137 Yanwachi Road, Changsha, Hunan 410073,","place":["China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xionglve","family":"Li","sequence":"additional","affiliation":[{"name":"College of Computer Science and Technology , National University of Defense Technology, 137 Yanwachi Road, Changsha, Hunan 410073,","place":["China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Bingnan","family":"Hou","sequence":"additional","affiliation":[{"name":"College of Computer Science and Technology , National University of Defense Technology, 137 Yanwachi Road, Changsha, Hunan 410073,","place":["China"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhiping","family":"Cai","sequence":"additional","affiliation":[{"name":"College of Computer Science and Technology , National University of Defense Technology, 137 Yanwachi Road, Changsha, Hunan 410073,","place":["China"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"286","published-online":{"date-parts":[[2026,2,23]]},"reference":[{"key":"2026062008162969600_ref1","first-page":"537","article-title":"Measuring the deployment of IPv6: topology, routing and performance","volume-title":"Proceedings of the ACM Internet Measurement Conference (IMC)","author":"Dhamdhere","year":"2012"},{"key":"2026062008162969600_ref2","doi-asserted-by":"publisher","first-page":"109987","DOI":"10.1016\/j.comnet.2023.109987","article-title":"6Search: A reinforcement learning-based traceroute approach for efficient IPv6 topology discovery","volume":"235","author":"Liu","year":"2023","journal-title":"Comput Netw"},{"key":"2026062008162969600_ref3","doi-asserted-by":"publisher","first-page":"903","DOI":"10.1109\/TMC.2007.1010","article-title":"Adaptive route optimization in hierarchical mobile IPv6 networks","volume":"6","author":"Pack","year":"2007","journal-title":"IEEE Trans Mob Comput"},{"key":"2026062008162969600_ref4","doi-asserted-by":"crossref","first-page":"1337","DOI":"10.1093\/icc\/dtab053","article-title":"Regulating digital ecosystems: bridging the gap between competition policy and data protection","volume":"30","author":"Kira","year":"2021","journal-title":"Industrial and Corporate Change"},{"key":"2026062008162969600_ref5","doi-asserted-by":"crossref","DOI":"10.1109\/INFOCOM42981.2021.9488794","article-title":"6Hit: A reinforcement learning-based approach to target generation for internet-wide IPv6 scanning","volume-title":"Proceedings of the IEEE International Conference on Computer Communications (INFOCOM)","author":"Hou","year":"2021"},{"key":"2026062008162969600_ref6","doi-asserted-by":"crossref","DOI":"10.1109\/INFOCOM53939.2023.10229089","article-title":"Search in the expanse: Towards active and global IPv6 hitlists","volume-title":"Proceedings of the IEEE International Conference on Computer Communications (INFOCOM)","author":"Hou","year":"2023"},{"key":"2026062008162969600_ref7","doi-asserted-by":"crossref","DOI":"10.1109\/TNET.2023.3233953","article-title":"6Scan: a high-efficiency dynamic internet-wide IPv6 scanner with regional encoding","volume":"31","author":"Hou","year":"2023","journal-title":"IEEE\/ACM Trans Netw"},{"key":"2026062008162969600_ref8","first-page":"1","article-title":"A comprehensive study of accelerating IPv6 deployment","volume-title":"Proceedings of the IEEE International Performance Computing and Communications Conference","author":"Cui","year":"2019"},{"key":"2026062008162969600_ref9","volume-title":"Nmap: The Network Mapper - Free Security Scanner","author":"Nmap","year":"2021"},{"key":"2026062008162969600_ref10","doi-asserted-by":"crossref","first-page":"195","DOI":"10.1145\/2637364.2591972","article-title":"Hershel: single-packet os fingerprinting","volume":"42","author":"Shamsi","year":"2014","journal-title":"ACM SIGMETRICS Performance Evaluation Review"},{"key":"2026062008162969600_ref11","first-page":"89","article-title":"Illuminating router vendor diversity within providers and along network paths","volume-title":"Proceedings of the ACM Internet Measurement Conference (IMC), Montr\u00e9al, QC, Canada","author":"Albakour","year":"2023"},{"key":"2026062008162969600_ref12","doi-asserted-by":"crossref","first-page":"150","DOI":"10.1145\/3487552.3487848","article-title":"Third time\u2019s not a charm: exploiting snmpv3 for router fingerprinting","volume-title":"Proceedings of the ACM Internet Measurement Conference (IMC), Virtual Event","author":"Albakour","year":"2021"},{"key":"2026062008162969600_ref13","doi-asserted-by":"publisher","first-page":"17","DOI":"10.1007\/978-3-540-85074-8_2","article-title":"Overview of security protocol analysis","volume":"5111","author":"Chen","year":"2008","journal-title":"Secure Transaction Protocol Analysis: Models and Applications"},{"key":"2026062008162969600_ref14","article-title":"A review of network traffic analysis and prediction techniques","author":"Joshi","year":"2015"},{"key":"2026062008162969600_ref15","doi-asserted-by":"publisher","first-page":"713","DOI":"10.1016\/j.eswa.2005.05.002","article-title":"An intelligent intrusion detection system (IDS) for anomaly and misuse detection in computer networks","volume":"29","author":"Depren","year":"2005","journal-title":"Expert Syst Appl"},{"key":"2026062008162969600_ref16","doi-asserted-by":"publisher","first-page":"134","DOI":"10.1016\/j.istr.2005.08.001","article-title":"Intrusion detection systems and intrusion prevention systems","volume":"10","author":"Fuchsberger","year":"2005","journal-title":"Information Security Technical Report"},{"key":"2026062008162969600_ref17","first-page":"369","article-title":"Network fingerprinting: TTL-based router signatures","volume-title":"Proceedings of the ACM Internet measurement conference (IMC), Barcelona, Spain","author":"Vanaubel","year":"2013"},{"key":"2026062008162969600_ref18","volume-title":"Fingerprinting IPv4 and IPv6 Routers Using ICMP","author":"Bofman","year":"2019"},{"key":"2026062008162969600_ref19","article-title":"RFC 1700","author":"Postel"},{"key":"2026062008162969600_ref20","article-title":"Classifying network vendors at internet scale","volume-title":"CoRR","author":"Holland","year":"2006"},{"key":"2026062008162969600_ref21","first-page":"298","article-title":"An advanced approach for performing cyber fraud using banner grabbing","volume-title":"Proceedings of the International Conference on Contemporary Computing and Informatics","author":"Kaushik","year":"2022"},{"key":"2026062008162969600_ref22","doi-asserted-by":"crossref","first-page":"111658","DOI":"10.1016\/j.comnet.2025.111658","article-title":"BiRNN-SA: context-aware malicious network traffic detection using self-attentive bidirectional RNNs","volume":"272","author":"Ahmed","year":"2025","journal-title":"Comput Netw"},{"key":"2026062008162969600_ref23","first-page":"49","article-title":"Vulnerability scanner-banner grabbing: a study on exploit detection and PoC generation","volume":"2","author":"Dhariya","year":"2024","journal-title":"Sci Manag Des J"},{"key":"2026062008162969600_ref24","doi-asserted-by":"crossref","first-page":"111147","DOI":"10.1016\/j.comnet.2025.111147","article-title":"MTCR-AE: a multiscale temporal convolutional recurrent autoencoder for unsupervised malicious network traffic detection","volume":"261","author":"Ahmed","year":"2025","journal-title":"Comput Netw"},{"key":"2026062008162969600_ref25","first-page":"3366","article-title":"New directions in automated traffic analysis","volume-title":"Proceedings of the ACM SIGSAC Conference on Computer and Communications Security (CCS), Virtual Event, Republic of Korea","author":"Holland","year":"2021"},{"key":"2026062008162969600_ref26","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3690637","article-title":"DELM: deep ensemble learning model for anomaly detection in malicious network traffic-based adaptive feature aggregation and network optimization","volume":"27","author":"Ahmed","year":"2024","journal-title":"ACM Trans Priv Secur"},{"key":"2026062008162969600_ref27","first-page":"298","article-title":"An advanced approach for performing cyber fraud using banner grabbing","volume-title":"Proceedings of the International Conference on Contemporary Computing and Informatics, Greater Noida, Uttar Pradesh, India","author":"Kaushik","year":"2022"},{"key":"2026062008162969600_ref28","first-page":"280","article-title":"Destination reachable: What icmpv6 error messages reveal about their sources","volume-title":"Proceedings of the ACM Internet Measurement Conference (IMC), Madrid, Spain","author":"Holzbauer","year":"2024"},{"key":"2026062008162969600_ref29","article-title":"Macroscopic internet topology data kit","author":"CAIDA"},{"key":"2026062008162969600_ref30","article-title":"Ripe atlas","author":"RIPE NCC","year":"2021"},{"key":"2026062008162969600_ref31","first-page":"395","article-title":"Rusty clusters? Dusting an IPv6 research foundation","volume-title":"Proceedings of the 22nd ACM Internet Measurement Conference, IMC \u201922","author":"Zirngibl","year":"2022"},{"key":"2026062008162969600_ref32","doi-asserted-by":"publisher","first-page":"177","DOI":"10.1016\/j.procs.2015.06.020","article-title":"Optimizing security and address configuration in IPv6 SLAAC","volume":"54","author":"Shah","year":"2015","journal-title":"Procedia Computer Science"},{"key":"2026062008162969600_ref33","volume-title":"Organizationally Unique Identifier Database","author":"IEEE Registration Authority"},{"key":"2026062008162969600_ref34","doi-asserted-by":"crossref","first-page":"155","DOI":"10.1007\/978-3-642-36516-4_16","article-title":"IPv6 alias resolution via induced fragmentation","volume-title":"Proceedings of the Passive and Active Measurement (PAM), Hong Kong, China","author":"Beverly","year":"2013"},{"key":"2026062008162969600_ref35","doi-asserted-by":"crossref","first-page":"243","DOI":"10.1007\/978-3-319-76481-8_18","article-title":"A closer look at IP-ID behavior in the wild","volume-title":"Proceedings of the Passive and Active Measurement (PAM), Berlin, Germany","author":"Salutari","year":"2018"}],"container-title":["The Computer Journal"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/academic.oup.com\/comjnl\/article-pdf\/69\/6\/963\/67076121\/bxag004.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/academic.oup.com\/comjnl\/article-pdf\/69\/6\/963\/67076121\/bxag004.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,20]],"date-time":"2026-06-20T12:16:38Z","timestamp":1781957798000},"score":1,"resource":{"primary":{"URL":"https:\/\/academic.oup.com\/comjnl\/article\/69\/6\/963\/8495066"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,2,23]]},"references-count":35,"journal-issue":{"issue":"6","published-online":{"date-parts":[[2026,2,23]]},"published-print":{"date-parts":[[2026,6,20]]}},"URL":"https:\/\/doi.org\/10.1093\/comjnl\/bxag004","relation":{},"ISSN":["0010-4620","1460-2067"],"issn-type":[{"value":"0010-4620","type":"print"},{"value":"1460-2067","type":"electronic"}],"subject":[],"published-other":{"date-parts":[[2026,6]]},"published":{"date-parts":[[2026,2,23]]}}}