Research On IP Geolocation Technology Based On Topology Analysis

Nowadays,with the development of the Internet,cyberspace has become the fifth strategic space after "land,sea,air,and sky".Countries compete fiercely around cyberspace,and mastering resources in cyberspace can earn strategic initiative.IP geolocation technology is one of the key technologies to master the distribution of physical resources in network space.IP geolocation technology maps logical IP addresses to real geographic locations by analyzing IP related information such as network delay,hop count,and domain names,etc.IP geolocation technology is widely used in information push,copyright protection,privacy protection,and traceability of network attacks.However,the existing IP geolocation algorithms are constrained by factors such as delay inflation,diversity of network structure,and limited landmark resources,which result in their poor reliability,inability to locate some targets,and low geolocation accuracy.Motivated by above reasons,three IP geolocation algorithms are proposed to solve the above three problems.The main work and innovations are as follows:Existing delay-based IP geolocation algorithms are vulnerable to delay inflation,which reduces their reliability and applicability in dynamic networks,a city-level IP geolocation algorithm based on analysis of important nodes is proposed.The algorithm first selects evenly distributed landmarks on geography and constructs the network topology graph of the target city by the multi-source path detection to the selected landmarks.Then the nodes in the graph are analyzed from the perspective of topology graph and path respectively by the theory of complex network and ranking nodes to find the stable and reliable important routing nodes in the network.After that the important nodes are classified by two stages to determine the geographic location of the important nodes.Finally,the location of the target IP is estimated by the location of these important nodes.The geolocation experiment of more than 300,000 target IP in 40 cities in the United States and China shows that the algorithm can effectively overcome the impact of delay inflation.The geolocation accuracy is 97.07%,which is 3.94%-14.18% higher than the existing typical geolocation algorithms LGB,GBLC and PBG.Existing typical IP geolocation algorithms based on topology analysis are limited to the analysis of some special topological structures in the network,which may cause their failure to geolocate some IPs.To solve this problem,a city-level IP geolocation algorithm based on node feature extraction is proposed.The node features including delay threshold,hop threshold,hop ratio and loose connection are extracted from the paths of distributed vantage points to the target city to construct the IP geolocation table,which transforms the IP geolocation process to searching for matching items in the table and calculating probabilities of candidate city.Experimental results of 36 cities in China,the United States,and Japan show that the algorithm has strong robustness.When the connectivity of the topology graph is poor,the geolocation accuracy is 20.92% higher than that of the typical geolocation algorithm based on topology analysis PBG.The algorithm improves the accuracy of typical geolocation algorithms based on topology analysis such as PBG,Geo-RF,and HC-Po P.Combining with the algorithm,all their accuracy exceeds 97%,and the highest reaches 99.36%.Existing network measurement-based geolocation algorithms have poor geolocation performance when the number of landmarks is small.To solve this problem,a city-level IP geolocation algorithm based on topology graph decomposition is proposed.First,the network topology graph is constructed by detecting the IP segments covering the target city.Second,the topology graph is decomposed into several subgraphs which are then numbered.Third,the nodes in the path from different vantage points to the landmarks of target city ate converted into the numbers of subgraphs to construct the pattern path of the target city.Finally,target IP is geolocated by comparing its path with the pattern paths of target cities.The results of geolocation experiments in Guangdong,Henan,Liaoning,and four municipalities show that when the same geolocation accuracy is achieved,the number of landmarks used by the algorithm is 58.87% less than the typical geolocation algorithm Geo-Po P,and meanwhile the number of IPs located is more than four times by that Geo-Po P locates;when using the same small number of landmarks,the geolocation accuracy of the algorithm is 96.22%,which is 5.07% and 6.75% higher than the typical geolocation algorithms Geo-Po P and SLG.At the end of this paper,the work of this paper is summarized,the shortcomings in this work are pointed out,and the future research is prospected.