A street-level ipv6 geolocation method based on graph neural network

Abstract

This invention proposes a street-level IPv6 geolocation method based on graph neural networks to address the technical problem of low granularity in current IPv6 geolocation methods. The steps of this invention are as follows: Anonymize the obtained IP addresses and convert the latitude and longitude information of the landmarks into region codes; use a graph neural network to convert the processed node information into an attribute feature map; convert the edge feature information of the attribute feature map into edge weights through a learning-based approach; feed the node feature information into an improved GraphSAGE model, prune according to the edge weights, learn the information of neighboring nodes through convolution, and output the node information after node representation; combine the region code with the node attribute update matrix of the improved GraphSAGE model and put it into a hierarchical classification module for classification, outputting the target geolocation. This invention outperforms current IPv6 geolocation algorithms in terms of median error, average error, and maximum error.

Description

Technical Field

[0001] This invention relates to the technical field of IPv6 geolocation, and more particularly to a street-level IPv6 geolocation method based on graph neural networks. Background Technology

[0002] IP geolocation is a technology that allows users to infer the geographical location of a device based on the characteristics of its IP address (such as network measurements or queryable information), also known as network entity geolocation. IP geolocation has many applications, such as network security, where it can be used to verify and detect user login information, detect server intrusions, trace the source of illicit data transmissions, track the source of cyberattacks, curb cybercrime, and block certain areas of the network. In commercial marketing, IP geolocation can be used to target advertisements based on a user's geographical location and population density, or to provide geolocation information for targeted automatic web page translation or other commercial applications.

[0003] Based on the granularity of location and under non-cooperative conditions, existing IP geolocation algorithms can be divided into two categories: city-level and street-level. City-level algorithms, such as Constraint-based Geolocation (CBG), Learning-based Geolocation (LBG), and Ranging Nodes-based Geolocation (RNBG), have a median error distance within 100km. Street-level algorithms, such as Street-Level Geolocation (SLG), IdentificationRouters and Local Delay-based Geolocation (IRLD), Geolocation of covertcommunication entity on the Internet for post-steganalysis (MLP-Geo), and Exploiting Leaked Identifiers in IPv6 for Street-Level Geolocation (IPvSeeYou), have a median error distance within 10km. Among these, CBG, LBG, and RNBG algorithms are applicable to IPv4, while LatencyConstraints and Neighbor Sequences-based Geolocation (LCNS) is applicable to IPv6, but has lower geolocation accuracy. Most existing IPv6 geolocation algorithms are still at the city level.

[0004] With the depletion of IPv4 addresses, global IPv6 deployment has entered an accelerated phase. However, some differences exist between IPv4 and IPv6 addresses, making existing IPv4 geolocation methods (such as CBG, LBG, and RNBG algorithms) unsuitable for IPv6 networks. These methods may also produce unsatisfactory results due to imperfections in network routing and the sparsity of IPv6 addresses. Furthermore, existing IPv6 CBG and LCNS algorithms lack high geolocation accuracy and have a large median error distance. These differences include: 1) The vast IPv6 address space makes traversal probing impossible; 2) The sparsity of IPv6 addresses leads to address scarcity and significant time costs for measurement; 3) In the context of network security defense, network space mapping and reverse mapping (CASM) technologies result in a large number of anonymous servers; 4) Increased storage costs for IPv6 addresses and poor connectivity in IPv6 networks lead to numerous routes with loops and high latency. In addition, the network topology changes rapidly due to the continuous dynamic addition of new active IPs.

[0005] Current learning-based methods, such as machine learning and deep learning, including graph neural networks, have been widely used in the field of cybersecurity. This invention organically combines graph neural networks with computer networks to overcome the aforementioned limitations. Summary of the Invention

[0006] To address the technical problem of low granularity in current IPv6 geolocation methods, this invention proposes a street-level IPv6 geolocation method based on graph neural networks. This method filters all relevant routers serving a region through a learning-based approach, and then uses a hierarchical classification method to gradually converge the granularity of geographic location by narrowing down the region. This improves the granularity of geolocation in IPv6, and the geolocation model approaches the level of street-level geographic location.

[0007] To achieve the above objectives, the technical solution of the present invention is implemented as follows: a street-level IPv6 geolocation method based on graph neural networks, the steps of which are as follows:

[0008] Step 1, Preprocessing: Anonymize the obtained IP addresses to remove anonymous nodes, and convert the longitude and latitude in the landmark information into area codes; use a graph neural network to convert the information of the processed nodes into attribute feature maps;

[0009] Step 2, Pre-training: Convert the feature information of the edges in the attribute feature map into edge weights using a learning-based approach;

[0010] Step 3: Feed the feature information of the nodes, including IPv6 addresses and intermediate routing nodes, obtained in Step 1 into the improved GraphSAGE model. Prune the nodes according to the edge weights, learn the information of neighboring nodes through convolution, aggregate and update the node information, and output the node attribute update matrix after the node representation.

[0011] Step 4: Put the node attribute update matrix into the hierarchical classification module for classification, and output the target's region number, i.e., the target's geographical location.

[0012] Preferably, the anonymization process obtains path information from the target IP address through the Traceroute process detector, and the graph neural network encodes the information of nodes and topology to obtain an attribute feature map; the information of the node includes IP address V, delay D of the edge connected to the adjacent node, domain name query protocol information WH, intermediate routing node mid_route, and hostname.

[0013] Preferably, the method by which the graph neural network encodes information about nodes and topology is as follows: the topological relationships of the computer network are represented by an attribute feature graph using a graph neural network. ,in, It is a set of nodes. Represents the i-th network node in the computer network; It is a set of edges. Representative node With nodes The edge between; , Represents nodes The set of neighboring nodes; VX represents the features of each node; EX represents the features of the edges; Represents the critical matrix table, if the node With nodes There are connections between them, elements ,otherwise The critical matrix table A is a symmetric matrix.

[0014] Preferably, for data that fails to display nodes multiple times, the anonymization process is as follows:

[0015] (1) If the parent and child nodes of the two paths are the same, the anonymous route or multiple intermediate routes are equivalent to the shortest path route A as alias routes or load routes. Replace the IP of the anonymous route and multiple intermediate routes with the IP of the shortest path route A.

[0016] (2) When detectors I and II measure each other in the same area, the parent node I and child node II in the two paths are different, and the child node I and parent node II are also different. However, the alias detection algorithm is used to determine that the parent node I and child node II, and the child node I and parent node II are all alias routers. If their parent nodes and child nodes are the same, the anonymous node and the route are alias routes or load routes. Only one of the two paths is selected.

[0017] The method for converting landmark information into area codes is as follows: use a globally unified latitude and longitude system to divide the regions. Divide the candidate landmarks collected in the experiment into regions according to latitude and longitude. First, divide an experimental region into two parts using a binary method. Then, divide the regions into two parts again using the binary method. Convert the latitude and longitude of the landmarks into area codes corresponding to each region.

[0018] Preferably, the learning-based approach is implemented as follows:

[0019] The features EX of the edge are the latency D between the two IP devices on the edge, the similarity P between the two IPs, the domain name lookup protocol similarity Q, and the hostname similarity HN. ,node With nodes Delay between The set delay D is the original data;

[0020] The elements in the similarity P between two adjacent IPs are: ;

[0021] in, Representing an edge The two IP addresses have the same number of consecutive bits, where h represents the total number of bits in the IP address. This indicates the proportion of similarity between two IP addresses, and ;

[0022] The elements in the domain name query protocol similarity Q are: ;

[0023] in, Representing an edge The number of identical domain name query protocol entries between two connected IPs, where 'g' represents the total number of domain name query protocol entries. This indicates the similarity of the domain name lookup protocols of the two adjacent IPs, and ;

[0024] The elements in hostname similarity HN are: ;

[0025] in, Representing an edge The longest hostname string between two consecutive IP addresses. This represents two consecutive identical strings representing two connected IP addresses. Representing an edge Hostname similarity, and ;

[0026] Constructing a linear regression model: ;

[0027] in, Corresponding elements The weight, Represents the weight matrix. Represents the eigenvector. 1 is the bias constant. This is a linear regression model, and the output is the weights of the edges.

[0028] If the geographical distance between two nodes is less than a threshold T km, then ,otherwise T is a threshold parameter for the distance to the target IP address.

[0029] Calculate the total experimental dataset The values ​​are used to obtain the weights of all edges in the experimental dataset. , Representing an edge The weights are in the linear regression model. , Represents nodes Adjacent nodes The edges between them.

[0030] Preferably, the improved GraphSAGE model directly prunes the original network, deleting edges with low weights from neighboring nodes, changing the values ​​of elements with low weights in the critical matrix table A from 1 to 0, and retaining only the R edges with high weights for each node. During inference, the features of all R neighboring nodes of the target node are aggregated to the target node using random aggregation. The pruning operation is performed during the aggregation process, and values ​​with low weights do not participate in the aggregation and update operations. The retained weight values... Perform normalization and set thresholds for the weights. The sampling rule for neighboring nodes is: if a neighboring node has a value greater than the threshold... There are also cases where the value is less than the threshold. For nodes, only those greater than the threshold are selected. Random sampling is performed; if all neighboring nodes are greater than the threshold... All neighboring nodes are randomly sampled; if the number of all neighboring nodes is less than the threshold... No sampling is performed;

[0031] The aggregation is the process of transforming a set of node vectors into a vector using an aggregation function:

[0032] ;

[0033] Where k represents the number of aggregation layers, Represents a node Update the node attribute matrix after aggregation at the k-th layer. Represents a node To the node Aggregate functions in information transmission, Represents a node Features of surrounding neighbors aggregated at the k-th layer;

[0034] At the node The set of neighboring nodes After aggregation, based on the nodes Neighborhood aggregation representation and nodes The previous representation was a node. Create an updated representation:

[0035] ;

[0036] in, It is a differentiable function. This is the output value after the k-th layer update. Represents a node Update the node attribute matrix after aggregation at the k-th layer. This represents the result after the previous convolution;

[0037] The improved GraphSAGE model will include nodes Aggregate it with its neighboring points using a splicing method as follows:

[0038] ;

[0039] in, and These represent the linear transformations, i.e., the weight matrices, applied to the embedding of the central node and the aggregation of neighborhood messages, respectively. This represents the activation function.

[0040] Preferably, the aggregation functions are: Mean aggregation operator, pooling aggregation operator, and Long Short-Term Memory network aggregation operator;

[0041] The mean aggregation operator performs element-wise summation and averaging:

[0042] ;

[0043] The pooling aggregation operator transforms each neighbor node through a non-linear fully connected layer (MLP) and then performs one-dimensional pooling along the feature dimension. Indicates max pooling or average pooling:

[0044] ;

[0045] The aggregation operator for Long Short-Term Memory (LSTM) networks uses the randomly shuffled vector sets of neighboring nodes as input to the LSM network, i.e.:

[0046]

[0047] Preferably, in step four, the error between the geographic location output by the hierarchical classification model and the actual geographic location is calculated, and the parameters of the hierarchical classification model are adjusted through backpropagation and gradient descent; the target IP address is located based on the optimized hierarchical classification model, and the geographic location prediction result of the target IP is output.

[0048] Preferably, the hierarchical classification model includes multiple fully connected layers and a classification layer, with each layer followed by a fully connected layer; based on the classification result of the previous layer, the classification layer is sent to the next layer until the node is successfully classified;

[0049] A tree-like classification structure is established to classify the target multiple times through hierarchical classification: the root node of the tree is set as the city name, and the child nodes are the region numbers. The classification layer outputs the corresponding classification probabilities using a normalized exponential function. The category results are input to the next level, and the classification model of the next level is selected. Finally, the region number of the target IP is output. A greedy method is used to traverse downwards from the root node. For each leaf node, only the node with the highest probability is selected to continue traversing downwards until a node is below a set threshold or a leaf node is reached. One-hot encoding is used to encode the geographic location of the text. A vector with a maximum Len layer is created for each landmark, where Len is the depth of the hierarchical structure.

[0050] The classification layer uses a normalized exponential function to calculate nodes. exist The probability of the output node in the layer:

[0051]

[0052] Where ic represents the number of iterations. This represents the weight matrix of the classification layer; bias1 is the bias parameter. Represents a node exist The set of probabilities on the output nodes of the layer;

[0053] maximize Get Node The class CH with the highest probability, if If the value is greater than the threshold Q, then a second-level classification is performed. If the value is less than Q, the CH value is reduced to 1 using the function argmax, which maximizes the independent variable. All other values ​​in the vector are set to 0, and the one-hot encoded vector of each layer of the output node is generated. By mapping the encoding vector to the number, the one-hot encoding vector is... Convert to area code.

[0054] Preferably, the cross-entropy loss function is calculated for the loss at each level and the true value, and the final loss function is the sum of the losses at each level:

[0055] ;

[0056] in, This represents the final loss function value. Let Pr represent the cross-entropy loss function, where Pr is the predicted value and Y is the true value.

[0057] Compared with existing technologies, the advantages of this invention are as follows: This invention includes preprocessing, pretraining, an improved GraphSAGE, and hierarchical classification. In preprocessing, node features are processed and converted into node embeddings, and the latitude and longitude coordinates of landmarks are converted into region numbers. In pretraining, weights are assigned to edges between IP addresses, and node information is input into the improved GraphSAGE. After pruning according to the edge weights, the improved GraphSAGE performs graph convolution operations. Finally, hierarchical classification uses hierarchical classification to divide geographic locations into finer granularities to obtain the location of the target IP address. Experimental results on three datasets (covering Tokyo, New York, and Shanghai) show that the median error distance is in the range of 5.53-9.46 km, approaching the street-level positioning level. Compared with popular geolocation algorithms such as Street-Level Geolocation (SLG), Identification Routers and Local Delay-based Geolocation (IRLD), and Geolocation of covert communication entity on the Internet for post-steganalysis (MLP-Geo), this invention reduces the median error distance by at least 15.99% and the average error distance by at least 16.36%.

[0058] Meanwhile, this invention constructs relationships between nodes and edges, and uses deep learning to access neighbor information, overcoming limitations imposed by latency jitter and routing detours in IP measurement and positioning, thus providing a novel method for IPv6 street-level geolocation. This invention innovatively improves the sampling method of the GraphSAGE model by adding weighted sampling and pruning, while retaining more important neighbor node information for convolutional learning, effectively filtering noisy data. This invention uses a hierarchical classification method for IP geolocation classification, increasing the granularity of positioning through layer-by-layer convergence. Hierarchical classification enables multi-label classification, obtaining the minimum region to which the target belongs while maintaining a high success rate. Experimental results show that this invention outperforms current IPv6 geolocation algorithms in terms of median error, average error, and maximum error. Attached Figure Description

[0059] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0060] Figure 1 This is a flowchart of the present invention.

[0061] Figure 2 This is a schematic diagram of the anonymous routing process of the present invention, wherein (a) is the anonymous processing of different paths from the detector to the destination IP, and (b) is the anonymous processing of the detection path between two detectors.

[0062] Figure 3 This is a map showing the regional divisions of the Shanghai area.

[0063] Figure 4 This is a schematic diagram of the pruning operation of the present invention.

[0064] Figure 5 This is a flowchart illustrating the target IP location method of this invention. Detailed Implementation

[0065] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0066] like Figure 1As shown, a street-level IPv6 geolocation method based on graph neural networks (GWS-Geo model) includes preprocessing, pretraining, improved GraphSAGE, and hierarchical classification. Graph neural networks are introduced to improve the current IPv6 network's latency expansion and the scarcity of landmarks. Landmarks are converted from latitude and longitude to area codes. A hierarchical classification method is used to divide the granularity of location, achieving street-level location of the target IP. The specific implementation steps are as follows:

[0067] Step 1: Preprocessing: Anonymize the obtained Traceroute data to remove anonymous routes and convert the landmark information marked by latitude and longitude into area codes.

[0068] The anonymization process obtains path and edge latency information by processing IP addresses through Traceroute, and encodes node and topology information through a graph neural network.

[0069] The topological relationships of a computer network can be represented as attribute feature maps using graph neural networks. ,in, It is a set of nodes. Represents the i-th network node in the computer network; It is a set of edges. , Representative node With nodes The edges between them. , Represents nodes The set of neighboring nodes. VX represents the features of each node. EX represents the features of the edges. Represents the critical matrix table, if the node With nodes There are connections between them, elements ,otherwise Since the round-trip path of IP packets during Traceroute probing is consistent, it can be regarded as an undirected edge, and the critical matrix table A is a symmetric matrix.

[0070] For an unknown IP address, the information obtainable includes: the IP address, the intermediate route IP from the probe to the target IP, the latency from the probe to the target node, the domain name lookup protocol information of the IP address, the routing or host information of the device to which the IP address belongs (including hostname, operating system, device fingerprint, etc.), the IP address information obtained through commercial database queries, and the latency information between the two IPs (edges). Literature such as *Discovering the IPv6 network periphery* and *DynamIPs: analyzing address assignment practices in IPv4 and IPv6* demonstrates that IPv6 addresses, like IPv4 addresses, have prefix address block allocation rules. IP addresses with the same prefix address are more likely to belong to the same subnet. Due to the vast IPv6 address space, this is particularly evident in IPv6 networks. The shorter the latency between two devices, the closer the two devices are. However, the significant difference between channel length and actual geographical distance must still be considered. Therefore, the experiments in this invention only utilize the latency between two devices as an edge feature embedding. A latency change trend between a probe host and the target IP can be used to measure the cross-regional situation of the probe to the target IP, but embedding node or edge information is relatively difficult. If an identifier IP exists in the network, the routing path information from the probe to the target IP can be obtained through Traceroute. If the route passes through key nodes, it can be determined that the target IP belongs to the region of a certain identifier IP. If an IP is assigned to a community or enterprise, its domain name lookup protocol information can be obtained through auxiliary database information. Using network probing tools such as Zmap & Nmap, host information of the target IP can be obtained, such as hostname, operating system, and device fingerprint. The higher the hostname similarity, the higher the probability that the two hosts are in the same region. However, operating system and device fingerprint information are weak features, and embedding host information as features into graph neural networks is relatively difficult.

[0071] Ultimately, IP address, latency, domain name lookup protocol information, intermediate routing nodes (excluding router nodes between the detector and the target IP), and hostname were selected as features to be embedded in this invention. These are represented as V, D, WH, mid_route, and Hostname, respectively.

[0072] 1) Anonymization. When using a probe to perform traceroute to a target node, some nodes often have anonymous routes and the routing paths between nodes are not unique. Figure 2 These are two methods for handling anonymous routing. Experiments, through multiple measurements and analysis of IP addresses, show that some anonymous data can be displayed. For data from nodes that repeatedly fail to display, the following methods are used:

[0073] (1) If two paths have the same parent node (the one above the anonymous node) and child node (the one below the anonymous node), the anonymous route or multiple intermediate routes are equivalent to route A as alias routes or load routes. Replace the IP of the anonymous route * and the IP of the multiple intermediate routes with the IP of the shortest path route A.

[0074] (2) Using detectors A and B to measure each other in the same area, it was found in the experiment that the parent node 1 and child node 2 in the two paths are different, and the child node 1 and parent node 2 are also different. However, using the alias detection algorithm, it was determined that the parent node 1 and child node 2, and the child node 1 and parent node 2 are alias routers to each other. Based on the theory in (1), if its parent node (the previous path of the anonymous node) and child node (the next path of the anonymous node) are the same, it can be deduced that the anonymous node and route E are alias routes or load routes. Only one of the two paths is selected as experimental data.

[0075] Anonymization removes anonymous routes and some redundant routers, eliminates invalid data, and improves the accuracy of experiments.

[0076] 2) Landmark Processing. Geographical location can refer to the latitude / longitude coordinates of the target IP address, or it can be a coarser-grained location, such as a province, city, or street. This invention uses a globally unified latitude and longitude system to divide regions. The candidate landmarks collected in the experiment are divided according to latitude and longitude regions. First, a binary division method is used for each experimental region. Then, the regions after the binary division are further divided using the binary division method. The latitude and longitude of the landmarks are converted into a region number corresponding to each region. For example... Figure 3 As shown in the annotation, the initial landmark corresponds to latitude and longitude of 31.264222 and 121.485940, respectively. The conversion is as follows: Figure 3 The corresponding interval is shown. Figure 3 The Shanghai area is divided into latitude and longitude regions. A binary division method is used, with each region numbered to represent its position. This method follows a layered approach, enabling layer-by-layer target location and improving the granularity of the location.

[0077] Geographic location information is the desired outcome, and in the model, it becomes the model's label. Previously, geographic location information was a single numerical point; this invention replaces it with a latitude and longitude range, extending the IP location problem to a learning-based classification model for the first time (previous models were regression models), thus enhancing the applicability of the model to the IP location problem.

[0078] Step 2: Pre-training: Convert the edge feature information of the attribute feature map obtained by Traceroute into edge weight information.

[0079] The data features on the edges of the joint attribute feature graph and the features of the common dataset are used, with the common dataset being treated as one of the features of our edges. This includes domain name query protocol information and DNS domain name resolution information, which are transformed into edge weights through a learning-based approach.

[0080] Edges represent the connections between routers and are also edges in graph neural networks. Information between edges is crucial for IP localization, but the original GraphSAGE model cannot incorporate edge features into its computation. This invention filters edge features and transforms them into weights. This demonstrates that neighbors with higher edge weights have a greater influence on the target node and are more likely to belong to the same region. Compared to directly aggregating neighbor nodes, edge weights can be normalized before aggregation, then multiplied by the corresponding neighbor node features, and finally fused. The node weights in this invention can be determined during the pre-training phase, without affecting the running speed of the improved GraphSAGE model.

[0081] In this invention, the selected edge features EX are the latency D between two IP devices, the similarity P between the two IPs, the domain name lookup protocol similarity Q, and the hostname similarity HN, denoted as: P represents the set of IP similarity scores for edges in the experimental data. Node With nodes Delay between The original data is processed as follows:

[0082] (1)

[0083] in, Representing an edge The two IP addresses have the same number of consecutive bits, where h represents the total number of bits in the IP address. This indicates the proportion of similarity between two IP addresses. .

[0084] (2)

[0085] in, Representing an edge The number of identical domain name query protocol entries between two connected IPs, where 'g' represents the total number of domain name query protocol entries, including technical contact information, communication address, and network name, etc. This indicates the similarity of the domain name lookup protocols between two adjacent IP addresses. .

[0086] The router hostname contains IP address fields, static hostnames, hyphens (-), and periods (.), etc. This information is not very helpful in verifying whether two connected hosts belong to the same area, so it is removed during the calculation. The remaining characters are the key hostname string. For example, if the hostname is 01-01.uservoice.com, it will ultimately be processed as uservoice.

[0087] (3)

[0088] in, Representing an edge The longest hostname string between two consecutive IP addresses. This represents two consecutive identical strings representing two connected IP addresses. Representing an edge Hostname similarity, .

[0089] Constructing a linear regression model: (4)

[0090] in, Corresponding to The weights, expressed as vectors Represents the weight matrix. .use Represents the eigenvector. , The bias constant is This is a linear regression model, outputting the weights of the edges.

[0091] An experimental dataset was constructed based on landmark nodes whose edge distances were partially known. The connection value between edges represents the geographical proximity between nodes. The closer the geographical distance between nodes, the higher the edge weight. Empirically, a threshold T km is set between two nodes. Otherwise T is a threshold parameter for the distance to the target IP, which is set to 10km based on the model results.

[0092] The obtained weight matrix Combining the features of the edges, calculate the total experimental dataset. The values ​​are used to obtain the weights of all edges in the experimental dataset. , Representing an edge The weights are in the linear regression model. , Represents nodes Adjacent nodes The edges between them.

[0093] Step 3: Feed the node feature information obtained in Step 1, including IPv6 addresses and intermediate routing nodes mid_route, into the improved GraphSAGE model. Before learning the information of neighboring nodes through convolution, perform a pruning operation based on the edge weights, aggregate and update the node information, and output the node information after node representation.

[0094] Edges with low weights are removed based on their weights. The GraphSAGE layer is representative of non-spectral graph methods. The core idea of ​​GraphSAGE is the same as GCN, both belonging to graph convolutional networks within graph neural networks. GraphSAGE modifies GCN in two ways: First, it changes node training from full-graph training to node-centric mini-batch training by sampling neighbors. This sampling during training increases randomness, thereby enhancing the model's generalization ability. This invention introduces the random sampling step and graph convolution step from the GraphSAGE model and improves the sampling method to solve the localization problem. The graph convolutional neural network model first performs pruning operations based on edge weights, then inputs the node features VX into the improved GraphSAGE model. After computation by the improved GraphSAGE model, it outputs the learned node information.

[0095] Add information about the node's neighbors to the node. Model the network topology graph and feed the updated node attributes from the convolution into the hierarchical classification model.

[0096] For a node with high degree centrality, such as a Customer Premises Equipment (CPE) node or a central gateway node, the large number of surrounding neighbor nodes necessitates calculating a significant amount of neighbor information. This increases computational overhead. Furthermore, for IP location, a CPE node can achieve high accuracy with only a small number of neighboring nodes. Central gateway nodes, typically located in large switching centers, offer little assistance in IP location. The GraphSAGE model introduces sampling to reduce computational complexity. However, it is prone to feature instability during graph neural network training. While introducing stochastic processes during training aims to prevent overfitting in the GraphSAGE model, this stochastic process is intended to be removed during inference. Figure 4As shown, this invention directly prunes the original network topology, deleting edges with low weights from surrounding neighbors. In the critical matrix table A, edges with low weights are changed from 1 to 0, retaining only the R edges with higher weights for each node. During model inference, the features of all R neighboring nodes of the target node are aggregated to the target node using random aggregation. This ensures that the embedded features of nodes are identical while maintaining the network structure; it also significantly reduces the density of the graph structure and lowers memory overhead while ensuring greater model accuracy. The pruning operation is performed during aggregation; lower weights are not involved in aggregation and update operations. To reduce the difference in weights on edges, the retained weights... Perform normalization and set weight thresholds. , The weighting threshold of this invention Based on the model's output, select the threshold result that achieves the highest accuracy. Sampling rules:

[0097] (1) If there are neighboring nodes that are greater than the threshold There are also cases where the value is less than the threshold. For nodes, only those greater than the threshold are selected. Random sampling is performed.

[0098] (2) If all neighboring nodes are greater than the threshold All neighboring nodes are sampled randomly.

[0099] (3) If all neighboring nodes are less than the threshold No sampling is performed.

[0100] Aggregation is the process of transforming a set of node vectors into a vector using the aggregation function:

[0101] (5)

[0102] Where k represents the number of aggregation layers, Represents a node The node attribute update matrix after aggregation at the k-th layer, and the aggregation function. Represents a node To the node Methods of aggregation in information transmission Represents a node Three aggregation functions were used to aggregate the features of surrounding neighbors at the k-th layer: average sum, pooling, and long short-term memory (LSTM) network.

[0103] Mean is the mean / sum aggregation operator. Element-wise summation and averaging are the most direct aggregation operators. This type of operation is a linear approximation of graph convolution, i.e.:

[0104] (6)

[0105] Pooling involves transforming each neighbor through a non-linear fully connected layer (MLP), and then performing one-dimensional pooling along the feature dimension. It can be either max pooling or average pooling:

[0106] (7)

[0107] Compared to mean / sum aggregation, Long Short-Term Memory (LSTM) networks have greater expressive power. The symmetry property of aggregation functions ensures that neural network models can be trained and applied to feature sets of vertices with arbitrary order. However, LTM networks do not conform to the symmetric property; their inputs are ordered. Therefore, the vector sets of neighboring nodes are randomly shuffled and then used as input to the LTM network, i.e.:

[0108] (8)

[0109] in, This means inputting all nodes into a Long Short-Term Memory network in a random arrangement and taking the aggregated result of the final state.

[0110] At the node neighbor nodes combined After aggregation, the aggregation representation of node v is based on its neighborhood and the node. The previous representation was a node. Create an updated representation:

[0111] (9)

[0112] in, For any differentiable function, This is the output value after the k-th layer update. Represents a node Update the node attribute matrix after aggregation at the k-th layer. express The improved GraphSAGE model, after convolutional layers, also employs node... It is aggregated with its neighboring points using a concat method, preserving the original characteristics of the nodes for node differentiation.

[0113] The final improved GraphSAGE model formula is:

[0114] (10)

[0115] in, and These represent the linear transformations of the center node embedding and neighborhood aggregation messages, respectively; they are the weight matrices, which are also the parameters to be optimized in the model. This represents the Noise Rectified Linear (ReLU) activation function.

[0116] Step 4: Input the node update matrix of the improved GraphSAGE model into the hierarchical classification module for classification, and output the target geographic location. The node update matrix contains the updated attributes of the nodes and directly participates in the model's calculation.

[0117] The hierarchical classification module consists of multiple fully connected layers and a classification layer, with each layer followed by a fully connected layer. Based on the classification results of the previous layer, the classification layer sends data to the next layer until the node is successfully classified.

[0118] In previous localization models, most methods established a localization rule based on a series of features to establish a potential connection between the target IP and the landmark IP. This rule only makes a single determination on the target, but when there are insufficient landmarks, it may fail to locate the target or result in a large granularity of the localization result. This invention establishes a tree-like classification structure, classifying the target multiple times through hierarchical classification, gradually converging the localization granularity, and obtaining the smallest possible region to which the target belongs while ensuring accuracy. The root node of the tree is set as the city name, and the child nodes are the region numbers. A hierarchical model is constructed using a hierarchical normalized exponential function output layer. The hierarchical normalized exponential function has been widely implemented in language modeling and related fields. Due to the large number of classifications in language modeling, Qian et al. often use Huffman trees to construct a binary classification structure to improve model speed. This invention aims to construct a hierarchical model by building upon the structural information contained in the classification results themselves, and the concept of YOLO9000 is more in line with the localization idea of ​​this invention. This invention employs a greedy method, traversing downwards from the root node. For each leaf node in the first layer, only the node with the highest probability is selected to continue traversing downwards until a node falls below a set threshold or a leaf node is reached. The threshold level allows for a trade-off between accuracy and fine-grained localization. Since region IDs cannot directly participate in the classification model, this invention uses one-hot encoding to encode the geographic location of the text. A landmark is used to create a vector with a maximum layer length of Len, where Len is the depth of the hierarchical structure.

[0119] The hierarchical classification of this invention includes multi-level fully connected layers and classification layers, such as... Figure 1As shown. The fully connected layer can reduce the dimensionality of the feature matrix. After passing through the fully connected layer, a new matrix is ​​obtained and fed into the classification layer. The classification layer uses a hierarchical normalized exponential function to output the corresponding classification probability. The category result is then input to the next level, and the classification model for the next layer is selected. Finally, the region code of the target IP is output. The algorithm is shown below:

[0120] Algorithm 1:

[0121]

[0122] Where ic represents the number of iterations. The matrix represents the weight matrix in the hierarchical classification module. Len represents the number of layers in the model, and Q is the threshold for belonging to this class. The threshold is dynamically adjusted based on experimental results, and its value ranges from (0, 1). The final result of this invention, Q, is 0.5. Ch represents the node. The class with the highest probability Represents a node exist The layer output node represents the set of probabilities, where bias is the bias parameter. This represents the one-hot encoded vector for each node's first level, where X is the node's region number. First, initialize the matrix. Hierarchical classification uses a hierarchical normalized exponential function to output results. (The probability value of belonging to a certain class), if If it is greater than Q, then proceed to the second level of classification. If the result is less than Q, the result is output directly. The result is converted to CH value to 1 by finding the maximum value of the independent variable, and other values ​​in the vector are converted to 0. The result is output in one-hot encoded form and then converted into region number X.

[0123] During training, the category prediction layer is dynamic, and therefore the nodes involved in gradient backpropagation are also dynamic. To address this issue, a strategy is set: if a category prediction stops at a node of a certain level, then gradient backpropagation is only performed on that node and the nodes in the path above it. The classification model has many layers, denoted here as levels. For example, if the category prediction for a certain target is a first-level classification result, then all specific second-level nodes in its child nodes do not participate in the loss calculation; only the first-level loss is calculated. This invention calculates the cross-entropy loss function by comparing the loss of each level with the true value, and the final loss function is the sum of the losses of each level:

[0124] (11)

[0125] in, This represents the final loss function value. This represents the cross-entropy loss function, where Pr is the predicted value, Y is the output of the entire model, and Pr is the true value.

[0126] The target IP location steps of this invention are as follows:

[0127] like Figure 5 The diagram illustrates the target IP localization framework. First, the city-level geographic location of the target IP address is determined. Then, traceroute probing is performed using multiple probe sources deployed in various regions to ensure that the nodes of the target IP are associated with nodes in the existing attribute feature map. Simultaneously, information about the target IP's neighbors and the target IP's own nodes is obtained, including IP address, domain name lookup protocol information, hostname, routing IP, and the latency of edges connecting to adjacent nodes. One-dimensional vectors VX for nodes and EX for edges can be calculated, and edge weights are calculated based on a pre-trained model. The one-dimensional feature vectors of the nodes and neighbor node information are input into our model for hierarchical classification, ultimately yielding the target IP's region code.

[0128] This invention combines weighted sampling with the GraphSAGE model into a semi-supervised learning framework for hierarchical classification of networks with topological and attribute information. When using the mean / sum aggregation method, the time complexity of the model in this invention is O(n log n). Where k is the number of convolutional layers, and k+n is the number of convolutional layers plus the fully connected layer. When using Pooling and LSTM methods for aggregation, the time complexity is O(k+n). In traditional graph convolution models, adding an extra layer of MLP or LSTM computation during aggregation increases model complexity. Furthermore, edge weight calculations are performed before graph convolution operations and do not participate in the convolution operations themselves, resulting in matrix multiplication consuming a significant portion of the computation time. This invention, building upon the GraphSAGE model's sampling method, replaces random sampling with sampling based on nodes with specific weights, further reducing memory overhead and eliminating aggregation operations on nodes with low weights. Because the preprocessing stage reduces the number of one-dimensional vectors for nodes, the actual time complexity is lower than... and .

[0129] The data acquisition method of this invention:

[0130] One method involves obtaining the IPv4-IPv6 group through a website, filtering by domain name, resolving by DNS, and then obtaining the IPv4-IPv6 landmark group through filtering. Finally, only the responding IPv6 address is retained as the landmark.

[0131] Secondly, by obtaining IPv6 prefix information from public datasets such as APNIC and ARIN, and using the ipv666 tool (https: / / github.com / lavalamp- / ipv666 / ), the active IPv6 addresses were generated and retrieved based on the IPv6 prefix dataset using its internal modules. The experiment probed the prefix data for three months. To ensure data stability, measurements were taken at night, retaining IP addresses that remained active throughout the period. The geographical locations of these IP addresses were determined using multiple commercial databases, and IPv6 addresses with consistent geographical locations were selected as landmarks.

[0132] Experimental parameters of this invention: The GWS-Geo model was trained in the open-source machine learning library (PyTorch) using the Adaptive Moment Estimation (ADAM) optimizer and Back-Propagation (BP). Specific experimental environment and related parameters are shown in Table 1. All experiments were performed multiple times to ensure model performance stability. To reduce runtime, training was stopped when the error did not increase after more than 200 rounds. In the classification task, this invention focuses on the accuracy of IP localization classification, using classification evaluation metrics such as Positive Predictive Value (PPV), Micro F1, and confusion matrix to evaluate model performance. The experimental output is to locate the target in a certain region, which is a classification problem. To use the same evaluation metrics as existing IP localization methods, this invention converts the region number of the experimental classification into the latitude and longitude of the region center point, calculates the distance error between the model's localized target latitude and longitude and the target's true latitude and longitude, and uses median error, average error, and maximum error when comparing performance with other models.

[0133] Table 1 Experimental Environment and Parameter Settings

[0134]

[0135] This invention compares with similar related works including the SLG algorithm, IRLD algorithm, and MLP-Geo algorithm. Table 2 shows the median error, average error, and maximum error of the three algorithms in three regions. It can be seen that the SLG algorithm has the worst median error, average error, and maximum error. In the IRLD and MLP-GEO algorithms, the optimal baseline differs for different evaluation metrics due to differences in the number of landmarks and network connectivity. The model proposed in this invention is optimal in all regions and for all evaluation metrics, demonstrating strong generalization ability.

[0136] Table 2 Comparison of the present invention with three positioning algorithms

[0137]

[0138] Experimental results show that the present invention improves the granularity of geographic location in IPv6, and the geographic location model is close to the level of street-level geographic location.

[0139] This invention transforms the IP geolocation problem into a feature-learning-based classification problem, considering a broad set of potential features, including actively measuring more static features related to the target IP (hostname information, domain name lookup protocol information, and the IP address itself), and feeding the processed feature data into the GWS-Geo model. In three real-world datasets, the geolocation method of this invention outperforms current geolocation methods, validating the superiority of the GWS-Geo model. This invention provides a complete geolocation process to improve positioning accuracy and refine the granularity of geolocation in IPv6, demonstrating its better adaptability to the rapidly changing network structure of IPv6 networks.

[0140] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A street-level IPv6 geolocation method based on graph neural networks, characterized in that, The steps are as follows: Step 1, Preprocessing: Anonymize the obtained IP addresses to remove anonymous nodes, and convert the longitude and latitude in the landmark information into area codes; use a graph neural network to convert the information of the processed nodes into attribute feature maps; Step 2, Pre-training: Convert the feature information of the edges in the attribute feature map into edge weights using a learning-based approach; Step 3: Feed the feature information of the nodes, including IPv6 addresses and intermediate routing nodes, obtained in Step 1 into the improved GraphSAGE model. Prune the nodes according to the edge weights, learn the information of neighboring nodes through convolution, aggregate and update the node information, and output the node attribute update matrix after the node representation. Step 4: Put the node attribute update matrix into the hierarchical classification module for classification, and output the target's region number, i.e., the target's geographical location; In step four, the error between the geographic location output by the hierarchical classification model and the actual geographic location is calculated, and the parameters of the hierarchical classification model are adjusted through backpropagation and gradient descent; the target IP address is located based on the optimized hierarchical classification model, and the geographic location prediction result of the target IP is output. The hierarchical classification model includes multiple fully connected layers and a classification layer, with each layer followed by a fully connected layer; based on the classification result of the previous layer, the classification layer is sent to the next layer until the node is successfully classified. A tree-like classification structure is established to classify the target multiple times through hierarchical classification: the root node of the tree is set as the city name, and the child nodes are the region numbers. The classification layer outputs the corresponding classification probabilities using a normalized exponential function. The category results are input to the next level, and the classification model of the next level is selected. Finally, the region number of the target IP is output. A greedy method is used to traverse downwards from the root node. For each leaf node, only the node with the highest probability is selected to continue traversing downwards until a node is below a set threshold or a leaf node is reached. One-hot encoding is used to encode the geographic location of the text. A vector with a maximum Len layer is created for each landmark, where Len is the depth of the hierarchical structure. The classification layer uses a normalized exponential function to calculate nodes. exist The probability of the output node in the layer: ； Where ic represents the number of iterations. This represents the weight matrix of the classification layer; bias1 is the bias parameter. Represents a node exist The set of probabilities on the output nodes of the layer; Maximize probability Get Node The class CH with the highest probability, if If the value is greater than the threshold Q, then a second-level classification is performed. If the value is less than Q, the CH value is reduced to 1 by finding the function that maximizes the independent variable. All other values ​​in the vector are 0, outputting the one-hot encoded vector of each layer of the node. By mapping the encoding vector to the number, the one-hot encoding vector is... Convert to area code.

2. The street-level IPv6 geolocation method based on graph neural networks according to claim 1, characterized in that, The anonymization process obtains path information from the target IP address through the Traceroute process detector. The graph neural network encodes information about nodes and topology to obtain an attribute feature map. The node information includes IP address V, delay D of the edge connected to the adjacent node, domain name query protocol information WH, intermediate routing node mid_route, and hostname.

3. The street-level IPv6 geolocation method based on graph neural networks according to claim 2, characterized in that, The method by which the graph neural network encodes information about nodes and topology is as follows: the topological relationships of a computer network are represented by an attribute feature graph using a graph neural network. ,in, It is a set of nodes. Represents the i-th network node in the computer network; It is a set of edges. Representative node With nodes The edge between; , Represents nodes The set of neighboring nodes; VX represents the features of each node; EX represents the features of the edges; Represents the critical matrix table, if the node With nodes There are connections between them, elements ,otherwise The critical matrix table A is a symmetric matrix.

4. The street-level IPv6 geolocation method based on graph neural networks according to claim 3, characterized in that, For data where nodes fail to display multiple times, the method for anonymization is as follows: (1) If the parent and child nodes of the two paths are the same, the anonymous route or multiple intermediate routes are equivalent to the shortest path route A as alias routes or load routes. Replace the IP of the anonymous route and multiple intermediate routes with the IP of the shortest path route A. (2) When detectors I and II measure each other in the same area, the parent node I and child node II in the two paths are different, and the child node I and parent node II are also different. However, the alias detection algorithm is used to determine that the parent node I and child node II, and the child node I and parent node II are all alias routers. If their parent nodes and child nodes are the same, the anonymous node and the route are alias routes or load routes. Only one of the two paths is selected. The method for converting landmark information into area codes is as follows: use a globally unified latitude and longitude system to divide the regions. Divide the candidate landmarks collected in the experiment into regions according to latitude and longitude. First, divide an experimental region into two parts using a binary method. Then, divide the regions into two parts again using the binary method. Convert the latitude and longitude of the landmarks into area codes corresponding to each region.

5. The street-level IPv6 geolocation method based on graph neural networks according to claim 3 or 4, characterized in that, The implementation method of the learning-based approach is as follows: The features EX of the edge are the latency D between the two IP devices on the edge, the similarity P between the two IPs, the domain name lookup protocol similarity Q, and the hostname similarity HN. ,node With nodes The time delay between The set time delay D is the original data; The elements in the similarity P between two adjacent IPs are: ; in, Representing an edge The two IP addresses have the same number of consecutive bits, where h represents the total number of bits in the IP address. This indicates the proportion of similarity between two IP addresses, and ; The elements in the domain name query protocol similarity Q are: ; in, Representing an edge The number of identical domain name query protocol entries between two connected IPs, where 'g' represents the total number of domain name query protocol entries. This indicates the similarity of the domain name lookup protocols of the two adjacent IPs, and ; The elements in hostname similarity HN are: ; in, Representing an edge The longest hostname string between two consecutive IP addresses. This represents two consecutive identical strings representing two connected IP addresses. Representing an edge Hostname similarity, and ; Constructing a linear regression model: ; in, Corresponding elements The weight, Represents the weight matrix. Represents the eigenvector. 1 is the bias constant. This is a linear regression model, and the output is the weights of the edges. If the geographical distance between two nodes is less than a threshold T km, then ,otherwise T is a threshold parameter for the distance to the target IP address. Calculate the total experimental dataset The values ​​are used to obtain the weights of all edges in the experimental dataset. , Representing an edge The weights are in the linear regression model. , Represents nodes Adjacent nodes The edges between them.

6. The street-level IPv6 geolocation method based on graph neural networks according to claim 5, characterized in that, The improved GraphSAGE model directly prunes the original network, deleting edges with low weights from neighboring nodes and changing the values ​​of the corresponding low-weight edges in the critical matrix A from 1 to 0, retaining only the R edges with high weights for each node. During inference, the features of all R neighboring nodes of the target node are aggregated to the target node using random aggregation. The pruning operation is performed during the aggregation process, and low-weight values ​​do not participate in the aggregation and update operations. The retained weight values... Perform normalization and set thresholds for the weights. The sampling rule for neighboring nodes is: if a neighboring node has a value greater than the threshold... There are also cases where the value is less than the threshold. For nodes, only those greater than the threshold are selected. Random sampling is performed; if all neighboring nodes are greater than the threshold... All neighboring nodes are randomly sampled; if the number of all neighboring nodes is less than the threshold... No sampling is performed; The aggregation is the process of transforming a set of node vectors into a vector using an aggregation function: ； Where k represents the number of aggregation layers, Represents a node Update the node attribute matrix after aggregation at the k-th layer. Represents a node To the node Aggregate functions in information transmission Represents a node Features of surrounding neighbors aggregated at the k-th layer; At the node The set of neighboring nodes After aggregation, based on the nodes Neighborhood aggregation representation and nodes The previous representation was a node. Create an updated representation: ； in, It is a differentiable function. This is the output value after the k-th layer update. Represents a node Update the node attribute matrix after aggregation at the k-th layer. This represents the result after the previous convolution; The improved GraphSAGE model will include nodes Aggregate it with its neighboring points using a splicing method as follows: ； in, and These represent the linear transformations, i.e., the weight matrices, applied to the embedding of the central node and the aggregation of neighborhood messages, respectively. This represents the activation function.

7. The street-level IPv6 geolocation method based on graph neural networks according to claim 6, characterized in that, The aggregation functions are: Mean aggregation operator, pooling aggregation operator, and Long Short-Term Memory network aggregation operator; The mean aggregation operator performs element-wise summation and averaging: ； The pooling aggregation operator transforms each neighbor node through a non-linear fully connected layer (MLP) and then performs one-dimensional pooling along the feature dimension. Indicates max pooling or average pooling: ； The aggregation operator for Long Short-Term Memory (LSTM) networks uses the randomly shuffled vector sets of neighboring nodes as input to the LSM network, i.e.:

8. The street-level IPv6 geolocation method based on graph neural networks according to claim 1 or 7, characterized in that, For each level, the cross-entropy loss function is calculated using the loss and the true value. The final loss function is the sum of the losses from each level. ； in, This represents the final loss function value. Let Pr represent the cross-entropy loss function, where Pr is the predicted value and Y is the true value.

Images