A target-driven IP address geographical location inference method

Abstract

The present invention discloses a target-driven method for inferring the geographical location of an IP address. The method first collects anchor nodes based on the target IP; then, screens and calibrates the anchor nodes; finally, conducts comprehensive detection on the target IP to construct a target profile for high-precision positioning. Through the present invention, the usage information of the IP address can be effectively inferred, effectively solving the problem of low efficiency in blindly obtaining anchor nodes on a large scale, and the accuracy of comprehensive inference of IP usage information can be further improved through more effective anchor nodes. By comparing and analyzing the topological paths of the anchor nodes and the IP to be measured, the usage and positioning information of the IP to be measured are comprehensively inferred according to the path approximation principle and geographical location information.

Description

Technical Field

[0001] The present invention relates to the technical field of target IP building-level positioning, and in particular to a building-level IP positioning method based on target-driven and IP comprehensive inference. Background Art

[0002] Currently, the common method of IP positioning is to estimate its geographical location by means of various information such as the path of the IP, reference nodes, bearer service information, Whois data, etc. The basic principle of positioning algorithm design is to minimize the measurement overhead while ensuring the positioning accuracy, and at the same time have good scalability and do not require client support. The initial positioning algorithm inferred the geographical location of IP devices by querying DNS servers or mining information hidden in hostnames. In recent years, probability-based positioning algorithms have become a research hotspot again, and positioning is carried out by finding the distribution law of delay and geographical distance. Since there are many IP positioning algorithms, they can be classified according to different criteria such as whether client support is required and positioning principles. Among the existing positioning algorithms, the client-based positioning algorithm has the highest accuracy, but it often relies on infrastructure such as GPS, cellular base stations, and WiFi access points. These data are either from the parsing of Whois data, or from operator data, or from the analysis of network data, and their positioning accuracy and accuracy cannot be guaranteed, thus greatly affecting the scope of use of IP positioning data. Although researchers have proposed many IP positioning algorithms, due to the lack of a large number of reference nodes, large-scale deployment cannot be carried out to obtain highly accurate results. Summary of the Invention

[0003] In order to overcome the above problems existing in the prior art, the present invention proposes a target-driven IP address positioning algorithm, which dynamically collects positioning anchor nodes around the IP address positioning target, and then infers the geographical location of the target IP through path similarity comparison. By this method, large-scale network space detection and anchor node collection can be avoided, thereby reducing the overhead of network space measurement and achieving high-precision IP address positioning. The positioning accuracy can reach the block level or even the building level. To achieve the above technical objectives and technical effects, the present invention is realized through the following technical solutions:

[0004] Step 1: Anchor node information collection, obtaining anchor nodes from the target IP network segment;

[0005] Step 2: Anchor node information calibration, determining the validity and node type of the anchor node according to the node device type information;

[0006] Step 3: Geographical location inference, inferring its geographical location by measuring the similarity between the path of the IP to be located and the path of the anchor node;

[0007] A target-driven method for inferring the geographical location of IP addresses, comprising the following steps:

[0008] The present invention aims at the lack of a large number of benchmark nodes in the IP positioning algorithm, which makes it impossible to deploy on a large scale to obtain high-accuracy positioning, and provides a target-driven method for inferring the geographical location of IP addresses. This algorithm establishes a set of effective anchor nodes within the target IP network segment, classifies according to the response network measurement situation of the target IP address, measures the IP that responds to the measurement using Traceroute to obtain the network path to the target node, and then selects the N IP addresses closest to this node by the path matching method, and uses the centroid method or the nearest neighbor method to determine the geographical location of the target IP. The positioning method of the present invention has a relatively high building-level positioning accuracy. Description of the Drawings

[0009] Figure 1 is the flowchart of the positioning algorithm of the present invention;

[0010] Figure 2 is the measurement schematic diagram of the present invention;

[0011] Table 1 shows the active IPs and ports within the network segment where the target IP of the present invention is located (detection results of the network segment 220.180.112.x of government and enterprise-related units on Duzhong Road, Qiaocheng District, Bozhou City, Anhui Province); Detailed Embodiments

[0012] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0013] As Figure 1 shown, a target-driven algorithm for inferring the using unit of an IP address of the present invention first determines whether the active IP in the network segment where the target IP is located is an anchor node; then judges whether the alternative anchor nodes are effective anchor nodes and server node types according to the target IP device type; finally, measures the network path to the target node through Traceroute, and then selects the N IP addresses closest to this node by the path matching method, and uses the centroid method or the nearest neighbor method to determine the geographical location of the target IP. The detailed algorithm process includes the following steps:

[0014] Step 1: By detecting well-known ports and registered ports, discover the active IP addresses in the C-class network segment where the IP address is located, and then detect the network services related to the location. If there are no effective anchor nodes in the C segment where the target IP is located, search for anchor nodes in the two adjacent network segments C-1 and C+1 until enough active anchor nodes are found. The open services detected by the device are expressed as:

[0015] Pi = {P1, P2, P3, P4, …, Pm} (1)

[0016] Step 2: Determine whether a node is a relay node based on its position in the network. Any IP that is not the last hop in the path library is regarded as a relay node, otherwise it is an end node. For all end nodes, according to the result of classifying the device type by the Bayesian decision network, determine whether it is a NAT gateway, a CDN node, and a server. If it is a server node, it is determined as an effective anchor node.

[0017] Among them, the probability that device Ei is ci is;

[0018] (2)

[0019] Assume that the services or ports opened by each network entity are independent. According to Bayesian theory, formula (2) can be expressed as:

[0020] P(M|c) = P({m1, m2, …, mn}|c) = P(m1|c)P(m2|c) … P(mn|c) (3)

[0021] Cluster the effective reference nodes according to the network path similarity of the anchor nodes. If the geographical distance of cluster Ci is greater than the radius of the city, it means it is a cloud node, otherwise it is an independent host.

[0022]

[0023] distance(Ci) = Max{ distance (loc(IPm), loc(IPn))} (4)

[0024] Among them, distance(Ai, Aj) is the distance between anchor nodes Ai and Aj, distance(Ci) is the distance of this cluster, and IPm, IPn ∈ Ci.

[0025] In this example, first detect all active IPs in the network segment 220.180.112.x / 24 where the IP is located, and the active IPs and their affiliated unit information are shown in Table 1.

[0026]

[0027] Table 1

[0028] Step 3: Classify the IP addresses into those that respond to network measurement and those that do not according to the situation of network measurement in response to the target IP address. The IP addresses that do not respond to the measurement can be replaced by the last-hop IP address on the measurement path; detect the fingerprint information of the node for the nodes that respond to the measurement. Determine the nature of the target node according to the method in Step 2. If the target node is a cloud computing node, obtain the geographical location of the cloud service provider by calling the Baidu interface; if it is an independent host, make a discrimination according to network topology proximity. First, measure the network path to the target node through Traceroute, and then select the N IP addresses closest to this node by the path matching method, and use the centroid method or the nearest neighbor method to determine the geographical location of the target IP.

[0029] If the centroid method is adopted, the target IP address is expressed as:

[0030] (1)

[0031] Among them, (latp, longp) represents the coordinates of the node to be determined, (lati, longi) represents the coordinates of node i.

[0032] If the best neighbor rule is adopted:

[0033] (2)

[0034] Finally, for the Traceroute measurement of these IP addresses, the second-to-last hop of the paths of the 3 IP addresses to be inferred is all "61.132.186.166", which is relatively similar to the topological paths of the 5 anchor node IP addresses 220.180.112.229, 220.180.112.232, 220.180.112.248, 220.180.112.249, and 220.180.112.149.

[0035] It can be seen from the above data that among all the websites in the C segment where the IP to be measured is located, there are 31 websites of government and enterprise-related units and 3 websites of other types. The websites of government and enterprise-related units account for 91%. Since most of the websites are those of government and enterprise-related units, it can be inferred that the IPs in this network segment are mainly used by government and enterprise-related units. At the same time, according to the principle of approximate topological paths, it can be further verified that these 3 IP addresses are all IP addresses used by government and enterprise units, and their real geographical locations are probably in the Bozhou Data Center.

[0036] The above has described the embodiments of the present invention in detail with reference to the accompanying drawings. However, the present invention is not limited to the above embodiments, and various changes can be made without departing from the gist of the present invention within the knowledge scope of those of ordinary skill in the art.

Claims

1. A target-driven IP address geographical location inference method, characterized in that: Including: Step 1: Anchor node information collection. Detect active IP addresses in the network segment where the target IP is located. If there are active IP addresses, collect their fingerprint features and determine whether they are anchor nodes. Step 2: Anchor node calibration. Determine whether each candidate anchor node is a valid anchor node and the corresponding server node type according to whether the anchor node has a clear geographical location. Step 3: Geographical location inference. By measuring the similarity between the path of the IP to be located and the path of the anchor node, for different types of target nodes, the centroid method or the method of substituting the address location of the adjacent anchor node can be used. In the said Step 2, determine whether it is a relay node by the position of the node in the network. Any IP that is not the last hop in the path library is regarded as a relay node, otherwise it is an end node. For all end nodes, determine whether they are NAT gateways, CDN nodes, and servers according to the result of classifying the device type by the Bayesian decision network. If it is a server node, it is determined as a valid anchor node. Among them, the probability that device Ei is ci is; (2) Assume that the services or ports opened by each network entity are independent. According to the Bayesian theory, formula (2) can be expressed as: P(M|c)=P({m1,m2,…,mn}|c)=P(m1|c)P(m2|c)…P(mn|c) （3） Cluster the valid reference nodes according to the network path similarity of the anchor nodes. If the geographical distance of cluster Ci is greater than the radius of the city, it means it is a cloud node, otherwise it is an independent host. distance(Ci)=Max{ distance (loc(IPm), loc(IPn))} （4） Among them, distance(Ai, Aj) is the distance between anchor nodes Ai and Aj, distance(Ci) is the distance of this cluster, and IPm, IPn ∈ Ci.

2. The target-driven IP address geographical location inference method according to claim 1, wherein: In the said Step 1, by detecting the well-known ports and registered ports, discover the active IP addresses in the C-class network segment where the IP address is located, and then detect the network services related to the location. If there are no valid anchor nodes in the C segment where the target IP is located, search for anchor nodes from the two adjacent network segments C-1 and C+1 until enough active anchor nodes are found. Among them, the open service detected by the device is expressed as: P i ={ P 1, P 2, P 3, P 4,…, P m}。 3. The target-driven IP address geographical location inference method according to claim 1, wherein: In step 3, according to the situation of the target IP address responding to network measurement, the IP addresses are divided into IPs that respond to the measurement and IPs that do not respond to the measurement; the IPs that do not respond to the measurement can be replaced by the last-hop IP address on the measurement path, and the fingerprint information of the node detection node that responds to the measurement is detected; the nature of the target node is determined according to the method in step 2. If the target node is a cloud computing node, the geographical location of the cloud service provider is obtained by calling the Baidu interface. If it is an independent host, it is discriminated according to network topology proximity. First, the network path to the target node is measured by Traceroute, and then N IP addresses closest to the node are selected by the path matching method, and the centroid method or the nearest neighbor method is used to determine the geographical location of the target IP; If the centroid method is adopted, the target IP address is expressed as: （1） If the best neighbor method is adopted, the target IP address is expressed as: （2） Among them, (latp, longp) represents the coordinates of the to-be-determined node, (lati, longi) represents the coordinates of node i.

Images