An IP Address Location Method Based on Graph Embedding and Generative Model

Abstract

The present invention discloses an IP address location method based on graph embedding and generative model, and its steps include: 1) collecting the geographical locations and auxiliary location features of multiple known IP devices; 2) constructing a graph structure composed of each IP node according to the auxiliary location features; 3) using a graph embedding model to generate the feature vectors of each IP node in the graph structure; 4) discretizing the geographical location information of each IP device, and setting the same discrete encoding of geographical information for the IP devices in the same region; 5) using a generative model to perform feature dimensionality reduction on the feature vectors of each IP node, and using the discrete encoding of the geographical information corresponding to the IP node to supervise and train the generative model, and taking the optimized generative model as the dimensionality reduction network; 6) for an IP device k to be located, generating the feature vector of the IP device k and inputting it into the dimensionality reduction network to predict the location result of the IP device k.

Description

Technical Field

[0001] The present invention relates to an IP address locating method based on a graph embedding and generation model, and belongs to the technical fields of network security and representation learning. Background Art

[0002] With the rapid development of information technology, people's social activities and network information technology are showing a trend of information integration and development. The positioning of devices that can access various information networks has important applications in various fields. From tracking and tracing in the field of network security supervision to advertising in the field of e-commerce, from smart device management in the field of medical health to fault recovery in the field of industrial control, network device positioning technology can provide support at different levels. Among traditional positioning methods, GPS, Wi-Fi, and base stations can all locate terminal devices, but they all require hardware support and users to actively upload data. Therefore, traditional positioning technology can only passively receive device location information and cannot actively detect device location information. In addition, for terminal devices such as fixed computers and IPTV that do not have GPS hardware devices, it is not possible to obtain device location information.

[0003] IP address positioning technology provides a way to proactively detect a device's geographic location, unrestricted by hardware requirements. This addresses the shortcomings of traditional positioning technologies, which rely on hardware devices and require active data upload. However, due to data privacy concerns, IP address positioning can only obtain a limited number of data samples, making data acquisition difficult. This makes training positioning models challenging. Summary of the Invention

[0004] In response to the technical problems existing in the prior art, the purpose of the present invention is to provide an IP address positioning method based on graph embedding and generative models. The device is profiled based on graph embedding technology, and the structural characteristics of the IP device in the entire network are described in the form of feature vectors by reducing the dimension of the graph structure. The positioning purpose is achieved by calculating the similarity and distance proximity of the IP addresses. At the same time, the method uses a generative model to learn the structure and other characteristics of the IP device and generate positioning data to achieve street-level IP address positioning.

[0005] Generative models are a new hot topic in current deep learning technology. Compared with discriminative models that need to learn conditional probability distributions, generative models are more difficult to train and have complex model structures. In addition to being able to generate new samples, generative models have also achieved great success in application fields such as feature dimensionality reduction, data denoising, image reconstruction, missing data filling, density estimation, style transfer, and semi-supervised learning. Considering that IP location technology has problems such as few data samples, difficult acquisition of data samples, and large data noise, the present invention introduces a generative model to make up for the deficiencies in data samples of IP location technology, no longer relying on the scale of training data, and at the same time improving the accuracy of the location model.

[0006] A graph embedding model is a method to represent each node in a graph structure in the form of a vector, aiming to represent graph nodes as low-dimensional feature vectors while preserving the structural features of the graph. The node feature vectors generated using the graph embedding method have the structural features of the node in the graph, and nodes with similar structures or close distances generate vectors with a certain degree of similarity. In the IP location method of the present invention, a graph embedding model is introduced to extract the structural features of each IP node, and then the IP address location is determined by virtue of the characteristic that IP addresses are close in distance, so as to improve the accuracy of IP address location.

[0007] To achieve this purpose, the technical solution of the present invention is as follows:

[0008] An IP address location method based on graph embedding and generative model, the steps of which include:

[0009] 1) Collect the geographical locations and auxiliary location features of multiple known IP devices;

[0010] 2) Construct a graph structure composed of each IP node according to the auxiliary location features; each IP node corresponds to an IP device;

[0011] 3) Use the graph embedding model to generate the feature vector of each IP node in the graph structure;

[0012] 4) Discretize the geographical location information of each IP device, and set the same discrete encoding of geographical information for IP devices in the same area;

[0013] 5) Use the generative model to perform feature dimensionality reduction on the feature vector of each IP node, and use the discrete encoding of the geographical information corresponding to this IP node for supervised training to optimize the generative model, and use the optimized generative model as the dimensionality reduction network;

[0014] 6) For an IP device k to be located, generate the feature vector of this IP device k according to the auxiliary location features of this IP device k and input it into the dimensionality reduction network, and predict the location result of this IP device k.

[0015] Further, the method for generating the feature vector of each IP node in the graph structure by using the graph embedding model is as follows:

[0016] 21) Take the reciprocal of the time delay information between two IP nodes in the graph structure as the jump probability between the corresponding two IP nodes;

[0017] 22) Use the random walk method to randomly select an IP node as the starting point and perform random jumps according to the jump probability to generate an IP device sequence;

[0018] 23) Repeat step 22) to generate multiple IP device sequences, and input each IP device sequence into the word2vec model to obtain the structural feature vector of the corresponding IP node;

[0019] 24) Discretize the auxiliary positioning feature of each IP node to obtain the basic feature vector of the corresponding IP node, and merge it with the structural feature vector of the corresponding IP node to obtain the feature vector of the corresponding IP node.

[0020] Further, the generation model is a masked autoencoder, and the method for obtaining the dimensionality reduction network is as follows:

[0021] 31) The masked autoencoder masks the basic feature vector in the feature vector of the current input IP node, randomly extracts some features in the basic feature vector and sets their values to 0;

[0022] 32) Use the vector obtained by dimensionality reduction output of the processed feature vector in step 31) as the predicted location of the current input IP node, calculate the Euclidean distance between the predicted location of the IP node and the discrete coding of the geographical information corresponding to the IP node, and add it to the loss function of the masked autoencoder;

[0023] 33) Ascend the vector output in step 32) to the dimension of the input feature vector, compare it with the feature vector input in step 31), calculate the Jaccard distance between the two vectors, and add it to the loss function of the masked autoencoder;

[0024] 34) Use the loss function to calculate the loss value to optimize the generation model, and use the optimized generation model as the dimensionality reduction network.

[0025] Further, generate the basic feature vector of the IP device k according to the auxiliary positioning feature of the IP device k; construct a network topology graph composed of the IP device k and other known IP devices according to the auxiliary positioning feature of the IP device k, and input it into the trained graph embedding model to obtain the structural feature vector of the IP device k; splice the structural feature vector of the IP device k with its basic feature vector to obtain the feature vector of the IP device k.

[0026] Further, the auxiliary positioning features include IP device information, IP device routing information, and IP device delay information; the geographical location is the longitude and latitude of the IP device location.

[0027] Further, the IP device information includes the IPv4 address of the IP device, the IP Internet service provider, the autonomous system ID where the IP is located, the country where the IP is located, the province where the IP is located, the city where the IP is located, and the IP usage scenario.

[0028] Further, the method for generating the discrete encoding of the geographical information of the IP device is as follows: The geographical areas where each IP device is located are divided into grids to obtain multiple areas and encode them. If the geographical location of the device IP belongs to area i, the encoding of area i is assigned to the IP device as the discrete encoding of the geographical information of the IP device.

[0029] A server, characterized in that it includes a memory and a processor, the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program includes instructions for executing the steps in the above method.

[0030] A computer-readable storage medium, on which a computer program is stored, characterized in that the steps of the above method are realized when the computer program is executed by a processor.

[0031] The IP address positioning method based on graph embedding and generative model of the present invention includes the following steps:

[0032] In the first step, collect the accurate geographical locations of each known IP device and other feature information for auxiliary positioning and perform preprocessing, and store them in a unified format to ensure the integrity and authenticity of the data.

[0033] In the second step, use methods such as ping to obtain the communication delay and routing path between each IP device, and construct a graph structure composed of IP nodes according to the path information and delay information.

[0034] In the third step, based on the constructed graph structure, introduce a graph embedding model for feature dimensionality reduction to generate a feature vector for each IP node. The steps include:

[0035] Store the generated graph structure in matrix form, and use the reciprocal of the delay information between two IP nodes as the jump probability between the corresponding two IP nodes;

[0036] Use the method of random walk, randomly select a starting point, and perform random jumps according to the jump probability between every two IP nodes to generate a sequence of IP devices;

[0037] Repeat the above process to generate multiple sequences of IP devices, and input them into the word2vec model for embedding, finally obtaining the structural feature vector data of each IP node;

[0038] Discretize the other basic features of each IP node to obtain basic feature vectors, and merge them with the structural feature vectors of this IP node obtained in the previous step, finally obtaining the feature vectors of each IP node. In this process, the transition probability between IP nodes should evenly express the homogeneity and structure of the network, that is, two nodes with short delay should have similar generated vectors and similar structures. For example, two nodes connected to the same several nodes should also have similar generated vectors. The sequence vectors generated by random jumps are not many, so the word2vec model adopts the CBOW algorithm suitable for small models. The method of this algorithm is to predict the central word through the surrounding words. In the scenario of IP positioning, the central node is predicted through the adjacent nodes of the graph. The merging of the basic feature vector and the structural feature vector of each node adopts the method of vector splicing, because the two features have no correlation in meaning, so methods such as point-by-point addition or vector multiplication should not be used.

[0039] Fourth, discretize the geographical information of the IP devices. Nodes within the same region have the same geographical information label. Although this will reduce the granularity of positioning, it can greatly improve the accuracy of positioning. The specific method is to divide the geographical area where the IP device is located into a grid of multiple regions and encode them. This encoding is a 1×2 vector. If the geographical coordinates of the device IP belong to a certain region i, the encoding of region i is assigned to this IP device as its location attribute. After the processing in step four, the discrete representation of the geographical information of each IP device is obtained, that is, the discrete encoding of the geographical information of this IP device.

[0040] Fifth, use a generative model to perform feature dimensionality reduction on the feature vectors generated by each IP device, and supervise them with the discrete encoding of the geographical information of the device. The generative model uses the Mask Auto Encoder (MAE). The specific steps are as follows:

[0041] First, perform a masking operation on the basic feature vectors in the feature vectors obtained by each IP device before, and randomly select 20% of the features and set their values to 0;

[0042] Then, input the feature vectors after the mask operation into a three-layer fully connected network to reduce their dimensionality to a 1×2 vector, and introduce the discrete encoding of geographical information to supervise this 1×2 vector. The specific method is to add the Euclidean distance between the two vectors to the loss function;

[0043] Then, input the 1×2 vector into another three-layer fully connected network to increase its dimension to that of the original feature vector, compare it with the original feature vector before masking, calculate the Jaccard distance between the two vectors, and optimize the generative model by adding it to the loss function, thereby optimizing the dimensionality reduction process.

[0044] Finally, use the optimized generative model as the dimensionality reduction network, which can reduce the feature vector to a 1×2 vector, and map this vector to the geographical area divided into grids, so as to realize the prediction of the location of IP devices.

[0045] Compared with the prior art, the positive effects of the present invention are as follows:

[0046] Aiming at the deficiencies of traditional IP positioning methods that rely on hardware and users' active uploads, the present invention combines emerging deep learning models, based on the graph embedding model, vectorizes the complex IP device network topology structure, and retains the homogeneity and structure of the network, maximizing the retention of the network structure information of IP devices. Through the discretization of geographical information, under limited data conditions, although the positioning granularity is reduced, the positioning accuracy is greatly increased. By using the MAE generative model to reduce the dimension of features, the information contained in the high-dimensional vector is maximally retained, and due to the introduction of the mask mechanism, the model also has the ability to shield abnormal data. To sum up, the present invention provides an effective method for IP positioning technology with high accuracy and less dependence on data. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 is a flowchart of an IP address positioning method based on graph embedding and generative model of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0048] To make the technical solutions of the present invention more obvious and understandable, specific embodiments are given and described in detail below in conjunction with the accompanying drawings.

[0049] Step 1: Data collection

[0050] The data used in the method of the present invention comes from the collection of basic information of IP devices, precise geographical information, IP device routing information, and delay information. The basic IP information includes IPv4 address, Internet service provider of the IP, autonomous system ID where the IP is located, country where the IP is located, province where the IP is located, city where the IP is located, and usage scenario of the IP. The precise address of the IP is the longitude and latitude of the location of the IP device. The IP device delay information is the time delay of the IP device sending requests to other devices or routers.

[0051] Step 2: Data preprocessing

[0052] A graph structure is established based on the collected delay information between various IP devices, and the graph structure is stored in the form of a sparse matrix. Each basic information of the IP device is discretized into a one-dimensional vector for representation. The cities where the IP devices are located are divided into square grids with a side length of 1 km and encoded. For example, the area in the first row and second column is encoded as [1, 2]. The precise geographical longitude and latitude information of the IP device is converted into an area code according to the area where it is located.

[0053] Step 3: Feature Encoding of Device Nodes

[0054] Use a graph embedding model to encode each node in the graph. Using the Node2vec technique, perform random walks on the nodes in the graph. The random walk probability is proportional to the reciprocal of the delay between nodes. The starting point of the walk is randomly generated, and random walks are performed according to the random walk probability between each node. Each time a node is passed, it is recorded. When the number of walks reaches the set number and stops walking, a node sequence can be obtained. This node sequence corresponds to a sentence in the word2vec task, each node corresponds to a word, and all the obtained sequences are input into the word2vec model to obtain the corresponding node vector for each node. The Word2vec model is implemented using the CBOW model. Its input window size is set to 5, which can better retain the structural features between nodes. If the window is too small or too large, it cannot well identify the structural features between nodes, which will cause the nodes that the model focuses on to be too concentrated or too scattered. Therefore, a window size of 5 is more appropriate. The CBOW model uses two fully connected layers as hidden layers, and the output layer size is the length of the node vector. In a node sequence, one node is removed, and the probability of predicting each node is used as the predicted value, and the true result is the true value. The cross-entropy is used as the loss function to calculate the loss, and the parameters of the CBOW hidden layer are continuously updated by backpropagation, and finally the trained graph embedding model is obtained.

[0055] Concatenate the one-dimensional basic feature vector of each IP node in Step 2 with the structural feature vector generated by the graph embedding model (i.e., the trained CBOW model) to finally obtain the feature vector of each node, which contains both the association information with other nodes and the basic information of the node itself, and can better support the IP positioning task.

[0056] Step 4: Use a generative model for feature dimensionality reduction and output geographical area codes

[0057] The generative model selects the MAE model to perform dimensionality reduction on the feature vectors generated in Step 3.

[0058] First, determine the features to be masked in the MAE model. Since the feature vectors generated in step three are divided into two parts: structural features and basic features, where the structural features represent the structural features with other nodes and thus cannot be masked. However, some of the basic features have relatively little impact on IP geographical location prediction or are affected by noise interference. Therefore, these features can be masked to enhance the robustness of the model. Each time, 20% of the basic features are masked.

[0059] Secondly, the network structure of the Encoder in the MAE model is a three-layer fully connected network, with the network structure being N×256×64×2, where N is the dimension of the feature vector in step three.

[0060] Thirdly, the network structure of the Decoder in the MAE model is a three-layer fully connected network, with the network structure being 2×64×256×N, where N is the dimension of the feature vector in step three.

[0061] The loss function of the MAE model is divided into two parts. The first part is the Jaccard distance between the feature vector generated by the Decoder and the original feature vector before masking. The second part is the Euclidean distance between the 1×2 vector generated by the Encoder and the regional code of this node in step two. Through backpropagation, the hidden layer parameters in the Encoder and Decoder are updated, and finally an IP location model is obtained, which is the Encoder in this process.

[0062] Step Five: Application of the Model

[0063] When a new IP device k is given, first, according to the data preprocessing steps in step two, obtain the basic information h of the IP device k and the delay information with other IP nodes, and generate a network topology graph composed of other nodes. Input this network topology graph into the trained graph embedding model in step three to obtain the structural feature vector of the IP device k, and splice it with its basic feature vector to finally obtain its feature vector. Put the generated feature vector into the trained Encoder model in step four to obtain a 1×2 geographical area code, and find the geographical area corresponding to this code in step two to determine the geographical location of this IP address.

[0064] The above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them. Those of ordinary skill in the art can modify or equivalently replace the technical solutions of the present invention. The protection scope of the present invention shall be subject to the claims.

Claims

1. An IP address location method based on graph embedding and generative model, the steps of which include: 1) Collect the geographical locations and auxiliary location features of multiple known IP devices; 2) Construct a graph structure composed of each IP node according to the auxiliary location features; each IP node corresponds to an IP device; 3) Use a graph embedding model to generate the feature vector of each IP node in the graph structure; 4) Discretize the geographical location information of each IP device, and set the same discrete coding of geographical information for the IP devices in the same area; 5) Use the generative model to perform feature dimensionality reduction on the feature vector of each IP node, and use the discrete coding of the geographical information corresponding to the IP node for supervised training to optimize the generative model, and use the optimized generative model as the dimensionality reduction network; the generative model is a masked autoencoder, and the method for obtaining the dimensionality reduction network is: 51) The masked autoencoder performs masking processing on the basic feature vector in the feature vector of the current input IP node, randomly extracts some features in the basic feature vector and sets their values to 0; 52) Use the vector output after dimensionality reduction of the feature vector processed in step 51) as the predicted location of the current input IP node, calculate the Euclidean distance between the predicted location of the IP node and the discrete coding of the geographical information corresponding to the IP node, and add it to the loss function of the masked autoencoder; 53) Dimensionally expand the vector output in step 52) to the dimension of the input feature vector, compare it with the input feature vector in step 31), calculate the Jaccard distance between the two vectors, and add it to the loss function of the masked autoencoder; 54) Use the loss function to calculate the loss value to optimize the generative model, and use the optimized generative model as the dimensionality reduction network; 6) For an IP device k to be located, generate the feature vector of the IP device k according to the auxiliary location features of the IP device k, and input it into the dimensionality reduction network to predict the location result of the IP device k.

2. The method according to claim 1, characterized in that, The method for using a graph embedding model to generate the feature vector of each IP node in the graph structure is: 21) Use the reciprocal of the time delay information between two IP nodes in the graph structure as the jump probability between the corresponding two IP nodes; 22) Use the method of random walk, randomly select an IP node as the starting point, and perform random jumps according to the jump probability to generate a sequence of IP devices; 23) Repeat step 22) to generate multiple sequences of IP devices, and input each sequence of IP devices into the word2vec model to obtain the structural feature vector of the corresponding IP node; 24) Discretize the auxiliary location features of each IP node to obtain the basic feature vector of the corresponding IP node, and merge it with the structural feature vector of the corresponding IP node to obtain the feature vector of the corresponding IP node.

3. The method according to claim 2, characterized in that, Generate a basic feature vector of the IP device k according to the auxiliary positioning features of the IP device k; construct a network topology map composed of the IP device k and other known IP devices according to the auxiliary positioning features of the IP device k and input it into the trained graph embedding model to obtain a structural feature vector of the IP device k; splice the structural feature vector of the IP device k with its basic feature vector to obtain a feature vector of the IP device k.

4. The method according to claim 1 or 2 or 3, characterized in that, The auxiliary positioning features include IP device information, IP device routing information, and IP device delay information; the geographical location is the longitude and latitude of the IP device location.

5. The method according to claim 4, wherein The IP device information includes the IPv4 address of the IP device, the IP Internet service provider, the autonomous system ID where the IP is located, the country where the IP is located, the province where the IP is located, the city where the IP is located, and the IP usage scenario.

6. The method according to claim 1, wherein The method for generating the discrete encoding of the geographical information of the IP device is as follows: divide the geographical area where each IP device is located into grids to obtain multiple regions and encode them. If the geographical location of the IP device belongs to region i, then assign the encoding of region i to the IP device as the discrete encoding of the geographical information of the IP device.

7. A server, characterized in that, It includes a memory and a processor, the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program includes instructions for executing each step in any one of the methods recited in claims 1 to 6.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, the steps of any one of the methods recited in claims 1 to 6 are implemented.

Images