City-level IP positioning method based on path characteristics

Abstract

The invention relates to a city-level IP positioning method based on path features, and belongs to the technical field of IP positioning, and the method comprises the following steps: S1, finding out a geographic position where a target IP may be located in a manner of querying an existing database, and recording the geographic position as a set D; s2, for each region in the set D, selecting part of landmarks from the landmark library of the response region according to a certain strategy, randomly selecting a plurality of detection sources, obtaining path information of the selected landmarks, and calculating path characteristics of the target regions according to landmark paths in the target regions; s3, acquiring an intermediate router interface IP and hop count information in a path from the detection source to the target IP, and taking the information as path characteristics of the target IP; and S4, obtaining the path features of the plurality of target regions and the path features of the target IP, then calculating the similarity of the two types of features, and taking the region with the highest similarity as the city region where the target IP is located.

Description

Technical Field

[0001] The invention belongs to the technical field of IP positioning, and relates to a city-level IP positioning method based on path features. Background Art

[0002] IP address is an important address for Internet to identify network assets and is a necessary condition for TCP / IP. IP positioning technology is the core of cyberspace mapping technology. Its purpose is to obtain the geographical location of network devices when only the IP address of the device is known. City-level positioning technology limits the accuracy of IP geolocation to the city level. Realizing city positioning is the basis for achieving higher accuracy (street level). The current mainstream positioning algorithms are GeoPing algorithm and LBG algorithm. These two types of algorithms belong to delay positioning algorithms. That is, based on the theoretical basis that "two adjacent nodes have similar delay vector characteristics, and the delay vectors of network entities with similar geographical locations are also similar", multiple detection elements are used to send packets to several landmark targets, calculate the Euclidean distance based on the delay vector, and obtain the estimation of the location of related targets by comparing the similarity. The problem with this type of algorithm is that factors such as network congestion, load balancing, and equipment performance differences will cause network delay expansion and understanding problems, which will affect the accuracy of the delay positioning algorithm. In addition, landmark performance differences will also affect positioning. For landmarks with poor performance, the queuing delay and processing delay of data packets will become longer, which will affect the positioning accuracy. On the other hand, in many cases, the correlation between the delay and distance between nodes is weak. The method of calculating the distance constraint for the target IP based on the delay is sometimes not ideal, so a regional positioning method that does not completely rely on the delay is needed. The currently commonly used CBG algorithm uses the detection source to calculate the corresponding distance constraint for the target, and finds the intersection of multiple regions to obtain the area where the target may exist. The defect is that the correlation between delay and distance is different in different regions. When the correlation is weak, it is difficult to use the prior relationship to describe the relationship between delay and geographical distance, which makes the CBG algorithm ineffective in some scenarios. Summary of the invention

[0003] In view of this, the object of the present invention is to provide a city-level IP positioning method based on path features.

[0004] In order to achieve the above object, the present invention provides the following technical solutions:

[0005] A city-level IP location method based on path features comprises the following steps:

[0006] S1: Find the possible geographical locations of the target IP by querying the existing database, recorded as set D;

[0007] S2: For each area in set D, select some landmarks from the landmark library of the response area according to a certain strategy, and randomly select multiple detection sources. Use the traceroute method to obtain the path information to the selected landmarks, and calculate the path characteristics of the destination area based on the landmark paths in each destination area.

[0008] S3: Use traceroute to obtain the IP addresses and hop counts of the intermediate router interfaces in the path from the detection source to the target IP address, and use this information as the path features of the target IP address.

[0009] S4: Through steps S2 and S3, the path characteristics of multiple destination areas and the path characteristics of the target IP are obtained. According to the relevant rule algorithm, the similarity of the two types of characteristics is calculated, and the area with the highest similarity is determined to be the urban area where the target IP is located.

[0010] Furthermore, step S1 includes using whois to query the geographic location information of the target IP, and using a public landmark database to query the location of landmarks that belong to the same network segment as the target IP.

[0011] Further, the calculation of the path characteristics of the destination area in step S2 includes the following steps:

[0012] S21: Let the path feature of the area be a triplet <number of hops, intermediate router interface IP, probability>, where the probability refers to the probability that the router appears on the communication path leading to the area. When extracting the path feature, only the C-segment IP of the router interface IP is recorded;

[0013] S22: The regional path feature extraction is divided into two parts: candidate feature extraction and feature probability calculation. For a certain detection source and destination area, a landmark located in the area is found from the landmark library, so that the landmark IP covers as many network segments as possible corresponding to the IP addresses in the area, and landmarks in a certain proportion to the total number of IP addresses in each network segment are selected;

[0014] S23: randomly selecting multiple detection sources, performing traceroute detection on the selected landmarks from the detection sources, and recording the router interface IP address and the corresponding hop count in the response data packet;

[0015] S24: remove the first m-hop router interface IPs close to the detection source in each communication path, where the value of m is determined according to the landmark path. For a reachable landmark IP, remove the last-hop routing IP on the path;

[0016] S25: Replace the IP addresses of all intermediate router interfaces on the path with the Class C addresses corresponding to the IP;

[0017] S26: for each intermediate router on all paths, count the interface IP address and the number of times the IP appears, and obtain a triplet <number of hops, router interface IP, number of times>, which is the candidate feature;

[0018] S27: In each area, a set of router information <number of hops, router interface IP, number of times> on the path from the detection source to the area is obtained, and the probability of the router appearing on the corresponding path of a certain area is calculated through the following steps: first, the number of times in the triples with the same number of hops in the candidate features of each area is added, and the obtained value becomes the cardinality of the hop; then the regional candidate feature triples are updated, and the ratio of the number of times to the cardinality of the hop is the probability that the router interface IP address appears on the path of a certain area, and the probability is used to replace the "number of times" in the triple, and the triple is now the regional path feature.

[0019] Further, the step S23 of performing traceroute detection on the selected landmark from the detection source specifically includes the following steps:

[0020] S231: ICMP packets are sent sequentially from the detection source to the forwarding devices along the path of the landmark IP address;

[0021] S232: ICMP response packets are received one hop, two hops, ..., n hops away from the detection source in sequence;

[0022] S233: Record the ICMP reply packet information received in sequence, including the hop count and IP address.

[0023] Further, step S3 specifically includes the following steps:

[0024] S31: Perform traceroute detection from the detection source to the target IP to obtain the path information between the detection source and the target IP;

[0025] S32: For the path information between the detection source and the target P, remove the first m-hop router interface IPs close to the detection source in each communication path, where the value of m is determined according to the landmark path; for the reachable landmark IP, remove the last-hop routing IP on the path, and replace the IP addresses of the intermediate router interfaces on all paths with the Class C addresses corresponding to the IP;

[0026] S33: The IP addresses of the intermediate router interfaces on the target path are regarded as a set of path features, and the probability of the features being included in the path features of each area is calculated;

[0027] S34: Select the area with the highest probability in step S33 as the location area of ​​the target IP.

[0028] Further, the probability calculation steps of the feature in step S33 that the feature is included in each regional path feature are as follows:

[0029] S331: The hop count and IP address of each return packet obtained by traceroute are taken as a tuple;

[0030] S332: Combine all the two-tuples from the detection source to the landmark to obtain a set (hop count, IP address), which contains all the two-tuples (hop count, IP address) from the detection source to the path;

[0031] S333: A set is also calculated for the target, and the similarity of the two sets is calculated using a neural network through a clustering method to determine the probability of the target falling into the area.

[0032] The beneficial effects of the present invention are as follows: The advantage of this method is that it uses path features instead of the dynamic delay of the traditional positioning method as the basis for determining the area where the target IP is located. The traditional method that relies on dynamic delay will be affected by network congestion, load balancing, differences in network equipment processing capabilities, landmark performance differences, etc., resulting in delay oscillations, which in turn affects IP positioning. The method using path features no longer relies on the strong correlation between delay and distance, but is related to the network architecture, protocol, and path equipment in the corresponding area. Therefore, it is more robust, less affected by external factors, and more accurate in positioning. In addition, since multiple detection sources are used to detect path features for multiple landmarks in different areas, there is no need to assume that the delay is linearly related to the distance. It is only necessary to consider the similarity between the target IP path features and the destination area path features. In summary, compared with existing methods, this method has different degrees of improvement in accuracy, stability, and robustness.

[0033] Other advantages, objectives and features of the present invention will be described in the following description to some extent, and to some extent, will be obvious to those skilled in the art based on the following examination and study, or can be taught from the practice of the present invention. The objectives and other advantages of the present invention can be realized and obtained through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to make the purpose, technical solutions and advantages of the present invention more clear, the present invention will be described in detail below in conjunction with the accompanying drawings, wherein:

[0035] Figure 1 This is the overall flow chart of the city-level IP positioning method based on path features;

[0036] Figure 2 Get the flow chart for the regional path feature. DETAILED DESCRIPTION

[0037] The following describes the embodiments of the present invention by specific examples, and those skilled in the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and the details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that the illustrations provided in the following embodiments only illustrate the basic concept of the present invention in a schematic manner, and the following embodiments and features in the embodiments can be combined with each other without conflict.

[0038] Among them, the drawings are only used for illustrative explanations, and they only represent schematic diagrams rather than actual pictures, and should not be understood as limitations on the present invention. In order to better illustrate the embodiments of the present invention, some parts of the drawings may be omitted, enlarged or reduced, and do not represent the size of actual products. For those skilled in the art, it is understandable that some well-known structures and their descriptions in the drawings may be omitted.

[0039] The same or similar numbers in the drawings of the embodiments of the present invention correspond to the same or similar parts; in the description of the present invention, it should be understood that if the terms "upper", "lower", "left", "right", "front", "rear", etc. indicate the orientation or position relationship, they are based on the orientation or position relationship shown in the drawings, which is only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operate in a specific orientation. Therefore, the terms describing the position relationship in the drawings are only used for illustrative purposes and cannot be understood as limiting the present invention. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to specific circumstances.

[0040] See also Figure 1-2 The present invention provides a city-level IP positioning method based on path features, comprising the following steps:

[0041] 1. Determine the destination area. By querying the existing database, find the geographical location where the target IP may be located, which is recorded as set D. For example, you can use whois to query the geographical location information of the target IP, and use the public landmark database to query the landmark location that belongs to the same network segment as the target IP.

[0042] 2. Let the path feature of the region be a triplet <number of hops, intermediate router interface IP, probability>, where probability refers to the probability that the router appears on the communication path leading to the region. Due to the existence of load balancing, multiple intermediate routers will be deployed at key nodes in the communication path between two entities, and a Class C address is usually located in the same region. Therefore, when extracting path features, only the C segment IP of the router interface IP is recorded.

[0043] 3. Such as Figure 2As shown in the figure, regional path feature extraction can be divided into two parts: candidate feature extraction and feature probability calculation. For a certain detection source and destination area, it is necessary to find landmarks located in the area from the landmark library so that the landmark IP covers as many network segments as possible corresponding to the IP addresses in the area, and in each network segment, landmarks are selected in a certain proportion to the total number of IP addresses in the network segment.

[0044] 4. Randomly select multiple detection sources, including self-built hosts or purchased cloud servers, and perform traceroute detection on the selected landmarks from the detection sources, and record the router interface IP address and the corresponding hop count in the response data packet. The specific steps of traceroute are as follows: ① Send ICMP packets from the detection source to the forwarding devices along the landmark IP address path in sequence. ② Receive ICMP reply packets from the detection source 1 hop, 2 hops, ... n hops away in sequence. ③ Record the ICMP reply packet information received in sequence, including the hop count and IP address.

[0045] 5. Since each detection path is generally not connected to the core transmission network within a few hops from the detection source, the difference will be relatively large. Therefore, remove the first m hops router interface IP close to the detection source in each communication path. The value of m needs to be determined according to the landmark path. For example, if the first 5 hops of the paths of landmarks in different areas are quite different, then m is 5. For reachable landmark IPs, the last hop routing IP on the path also needs to be removed.

[0046] 6. Replace the IP address of the intermediate router interface on all paths with the Class C address corresponding to the IP.

[0047] 7. For each intermediate router on all paths, count the interface IP address and the number of times the IP appears to obtain the triplet <number of hops, router interface IP, number of times>, which is the candidate feature.

[0048] 8. In step 7, a set of router information <number of hops, router interface IP, times> on the path from the detection source to the area will be obtained in each area. The probability of the router appearing on the corresponding path in a certain area needs to be calculated. The method is to first add the times in the triples with the same hop count in the candidate features of each area, and the value obtained becomes the cardinality of the hop. Then update the candidate feature triples of the area, and the ratio of the times to the cardinality of the hop is the probability that the router interface IP address appears on the path of a certain area. Use this probability to replace the "times" in the triple, and the triple is now the regional path feature.

[0049] 9. After obtaining the path features, since the path similarity from a detection source to the IP address in the same region is large, and the path similarity to the IP address in different regions is small, the path features can be used to locate the target IP. First, obtain the path features of the regions in set D through steps 3-8.

[0050] 10. Perform traceroute detection from the detection source to the target IP to obtain the path information between the detection source and the target P.

[0051] 11. Process the information obtained in step 10 using the methods of steps 5 and 6.

[0052] 12. Treat the IP of the intermediate router interface on the target's path as a set of path features, calculate the probability that the feature is included in the path features of each area, and use it as the probability that the target falls into the corresponding area. The probability calculation steps are as follows: the number of hops and IP of each jump back packet obtained by traceroute is taken as a tuple (number of hops, IP address); all tuples from the detection source to the landmark are combined to obtain a set, which contains all (number of hops, IP address) tuples on the path from the detection source. At the same time, a set is also calculated for the target. Through the clustering method, a neural network is used to calculate the similarity of the two sets to determine the probability of the target falling into the area.

[0053] 13. Select the area with the highest probability in step 12 as the location area of ​​the target IP.

[0054] 14. Through steps 3-13, the path characteristics of multiple destination areas and the path characteristics of the target IP are obtained. According to the relevant rule algorithm, the similarity of the two types of characteristics is calculated, and the area with the highest similarity is determined to be the urban area where the target IP is located.

[0055] Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the purpose and scope of the technical solution, which should be included in the scope of the claims of the present invention.

Claims

1. A city-level IP positioning method based on path features, characterized in that: The following steps are involved: S1: Find the possible geographical locations of the target IP by querying the existing database, recorded as set D; S2: For each area in set D, select some landmarks from the landmark library of the response area according to a certain strategy, and randomly select multiple detection sources. Use the traceroute method to obtain the path information to the selected landmarks, and calculate the path characteristics of the destination area based on the landmark paths in each destination area. S3: Use traceroute to obtain the IP addresses and hop counts of the intermediate router interfaces in the path from the detection source to the target IP address, and use this information as the path features of the target IP address. S4: The path characteristics of multiple destination areas and the path characteristics of the target IP are obtained through steps S2 and S3. The similarity of the two types of characteristics is calculated based on the relevant rule algorithm. The area with the highest similarity is determined to be the urban area where the target IP is located.

2. The city-level IP positioning method based on path features according to claim 1 is characterized in that: Step S1 includes using whois to query the geographic location information of the target IP and using a public landmark database to query the location of landmarks that belong to the same network segment as the target IP.

3. The city-level IP positioning method based on path features according to claim 1 is characterized in that: The step S2 of calculating the path characteristics of the destination area includes the following steps: S21: Let the path feature of the area be a triplet <number of hops, intermediate router interface IP, probability>, where the probability refers to the probability that the router appears on the communication path leading to the area. When extracting the path feature, only the C-segment IP of the router interface IP is recorded; S22: The regional path feature extraction is divided into two parts: candidate feature extraction and feature probability calculation. For a certain detection source and destination area, a landmark located in the area is found from the landmark library, so that the landmark IP covers as many network segments as possible corresponding to the IP addresses in the area, and landmarks in a certain proportion to the total number of IP addresses in each network segment are selected; S23: randomly selecting multiple detection sources, performing traceroute detection on the selected landmarks from the detection sources, and recording the router interface IP address and the corresponding hop count in the response data packet; S24: remove the first m-hop router interface IPs close to the detection source in each communication path, where the value of m is determined according to the landmark path. For a reachable landmark IP, remove the last-hop routing IP on the path; S25: Replace the IP addresses of all intermediate router interfaces on the path with the Class C addresses corresponding to the IP; S26: for each intermediate router on all paths, count the interface IP address and the number of times the IP appears, and obtain a triplet <number of hops, router interface IP, number of times>, which is the candidate feature; S27: In each area, a set of router information <number of hops, router interface IP, number of times> on the path from the detection source to the area is obtained, and the probability of the router appearing on the corresponding path of a certain area is calculated through the following steps: first, the number of times in the triples with the same number of hops in the candidate features of each area is added, and the obtained value becomes the cardinality of the hop; then the regional candidate feature triples are updated, and the ratio of the number of times to the cardinality of the hops is the probability that the router interface IP address appears on the path of a certain area, and the probability is used to replace the "number of times" in the triplet, and the triplet is now the regional path feature.

4. The city-level IP positioning method based on path features according to claim 3 is characterized in that: The step S23 of performing traceroute detection on the selected landmark from the detection source specifically includes the following steps: S231: ICMP packets are sent sequentially from the detection source to the forwarding devices along the path of the landmark IP address; S232: ICMP response packets that are 1 hop, 2 hops, ... n hops away from the detection source are received in sequence; S233: Record the ICMP reply packet information received in sequence, including the hop count and IP address.

5. The city-level IP positioning method based on path features according to claim 1 is characterized in that: Step S3 specifically includes the following steps: S31: Perform traceroute detection from the detection source to the target IP to obtain the path information between the detection source and the target IP; S32: For the path information between the detection source and the target P, remove the first m-hop router interface IPs close to the detection source in each communication path, where the value of m is determined according to the landmark path; for the reachable landmark IP, remove the last-hop routing IP on the path, and replace the IP addresses of the intermediate router interfaces on all paths with the Class C addresses corresponding to the IP; S33: The IP addresses of the intermediate router interfaces of the target path are regarded as a set of path features, and the probability of the features being included in the path features of each area is calculated; S34: Select the area with the highest probability in step S33 as the location area of ​​the target IP.

6. The city-level IP positioning method based on path features according to claim 5 is characterized in that: The steps for calculating the probability that the feature is included in each regional path feature in step S33 are as follows: S331: The hop count and IP address of each return packet obtained by traceroute are taken as a tuple; S332: Combine all the two-tuples from the detection source to the landmark to obtain a set (hop count, IP address), which contains all the two-tuples (hop count, IP address) from the detection source to the path; S333: A set is also calculated for the target, and the similarity of the two sets is calculated using a neural network through a clustering method to determine the probability of the target falling into the area.

Images