Localized Network Topology Analysis And Application In IP Geolocation

As a new type of strategic resources,cyberspace resources have been highly valued by all countries in the world.The network entity geolocation(IP geolocation)is the key technology of cyberspace resources mapping,whose purpose to determine the geographical location of network entities through the IP of entities,surrounding topology information and IP landmark information.The network entity geolocation technology has a broad application and development prospect in the field of civil and commercial market,as well as in the field of cyberspace security and national security.Aiming at the problems in the existing network entity geolocation technology,this dissertation developed the research in three aspects by analyzing the localized network topology at different levels: city area network topology analysis,target IP city-level geolocation and network IP landmark extension.1.Focusing on the issues in existing network topology research that the insufficiency acquisition of local area network topology information and the lack of correlation analysis with the actual geographical area,a new city area network topology analysis algorithm based on single hop delay is proposed.Firstly,analyze the detection messages under multiple protocols and various router alias resolution algorithms,and detect the target from multiple detection positions which are distributed deployed;secondly,a mess of detection data shows that single hop delay present "low-high-low" phenomenon in the communication process between network nodes inside and outside the city in the sa me ISP,and complete the analysis of detection path based on the phenomenon,then extract topology information such as network nodes inside the city area network,connection relationship between nodes and network delay.The experimental results show that the algorithm can improve the accuracy and integrity in the collection of network topology information,and can effectively achieve the acquisition and analysis of internal network topology of the urban area.2.Focusing on the issues that the result of existing city-level IP geolocation algorithms are influenced easily by the accuracy of time delay measurement and the unreachable target IP,a new city-level IP geolocation algorithm based on the PoP-level network topology analysis is proposed.Firstly,obtain the city level network topology information using existing city area network topology analysis algorithm;secondly,extract PoP level network in city area network based on the Bi-fan structure in PoP level network,and determine the geographic area of Po P level network according to IP landmarks in the Po P level network;finally,geolocate the target IP by analyzing whether or not the path between the source IP and target IP through a PoP level network.The experimental results show that the algorithm has a high success rate and accuracy rate of city-level geolocation,and can achieve a reliable city-level geolocation for some of the IP which cannot be detected.3.Aiming at the problem that the existing IP landmarks are mainly dependent on Web mining,can only obtain a limited number of IP landmarks,an IP landmark extension algorithm based on subnet analysis is proposed.Firstly,infer the subnet which IP landmarks belongs to,according to the characteristics that the network nodes within the same subnet have similar routing and similar geographic distribution;secondly,determine the location area of network nodes in the subnet using known location information of IP landmarks,so as to extend the number of IP landmark;finally,perform existing typical street level geolocation algorithm(SLG)based on the extended IP landmark set and the initial IP landmark set respectively,compare the positioning results and evaluate the reliability of IP landmark extension.The experimental results show that the proposed algorithm can greatly extend the number of IP landmarks,and the extended IP landmark has high reliability,which can effectively improve the accuracy of existing street-level geolocation algorithms.