IP anti-positioning method and system based on false Web landmark

Abstract

The invention discloses an IP anti-positioning method and system based on a false Web landmark. The method comprises the following steps: step 1, obtaining a network topology of a region where a protected target is located; 2, setting at least one Web server under a router directly connected with the protected target; 3, determining an offset distance according to the size of the urban area where the protected target is located; 4, determining a nominal position range of the false Web landmark according to the offset distance, and determining at least one disguise entity required by the false Web landmark in the nominal position range of the false Web landmark; and 5, constructing according to a preset website template and the information of the camouflage entity to obtain a false Web landmark, and deploying the false Web landmark on the Web server. According to the method, the false Web landmark which has landmark characteristics, but is false in nominal position, relatively low in delay with a protection target and relatively high in credibility can be generated, so that the positioning data of a localizer generates errors, and the IP anti-positioning effect is good.

Description

Technical Field

[0001] The present invention relates to the technical field of network space mapping, and in particular to an IP anti-positioning method and system based on false Web landmarks. Background Art

[0002] IP positioning is a technology that uses the IP address of an Internet device to determine its exact geographic location. IP positioning technology is of great value to many LBS services, such as personalized advertising services, local news push, network performance optimization, cybercrime tracing, etc. According to different positioning methods, IP positioning technology can be roughly divided into two or three categories: one is database-based IP positioning technology, the second is data mining-based IP positioning technology, and the third is network measurement-based IP positioning technology. Among them, IP positioning technology based on network measurement can give the street-level geographic location of network devices independent of the user, and has received great attention in recent years.

[0003] At present, the academic community is mainly concerned about how to improve the accuracy of measurement-based IP positioning. However, an important issue has been overlooked, that is, high-precision IP positioning technology that does not rely on users may be abused by network attackers. With the increasing accuracy of measurement-based IP positioning technology, especially network measurement-based IP positioning technology, due to its non-cooperative fine-grained positioning, network measurement-based IP positioning technology may become a tool for network attackers to steal network devices and users' precise geographic locations, as well as to deliver targeted phishing information and spread network viruses, which has a significant impact on network security and user privacy.

[0004] The technology to resist IP location based on network measurement is called IP anti-location technology, which can increase the error of IP location based on network measurement, or even make it fail. Existing IP anti-location methods can be divided into two main approaches: one is to hide the real IP, such as through VPN; the other is to mislead the location technology by modifying the data reply delay of the protected target. The above method can effectively resist city-level or national-level IP location based on network measurement, causing the national, provincial or city-level location obtained by the network attacker to have significant deviations.

[0005] However, the above method is difficult to apply to some other scenarios. First, many enterprises and even individuals need to use real IP to communicate with the outside world and provide services. Using VPN will greatly affect the normal working efficiency, such as large industrial enterprises. Second, for the second method mentioned above, due to the progress of IP positioning database, for some important network equipment (such as government official website servers, large enterprise network servers, etc.), users can often directly query their coarse-grained geographical location information (such as national and provincial geographical location information) through the database, and the accuracy of this information is more than 90% at the national level and more than 78% at the provincial level. Therefore, attackers can have a greater degree of confidence in determining the approximate national and provincial geographical locations of the protected targets. The existing IP anti-positioning method considers the protection of national-level locations and offsets the positioning results of network attackers by thousands or even tens of thousands of kilometers. At the same time, some important network facility IPs may be included in the IP positioning database, so that their national or even provincial geographical locations can be obtained by querying the database. In this case, the positioning results generated by the existing anti-positioning method, which are too different from the database query results, are easily judged by attackers as incorrect results, and even attract additional attention from attackers.

[0006] Moreover, the existing IP anti-positioning methods consider the protection of national-level locations, but do not consider the existing street-level IP positioning methods. However, street-level IP positioning with increasing accuracy is one of the main development directions of IP positioning. With the improvement of database accuracy, many companies pay more attention to the precise street-level geographic location of their key network equipment rather than the protection of national-level or even city-level locations. Summary of the invention

[0007] In order to at least partially solve the problem that the positioning result caused by the anti-positioning method is too offset and easily judged as an incorrect result by the attacker, and the existing IP anti-positioning method considers the protection of national-level locations but does not consider the existing street-level IP positioning method, the present invention provides an IP anti-positioning method and system based on false Web landmarks, by determining the offset distance of the false Web landmark and the nominal position range of the false Web landmark, and determining a disguised entity within the nominal position range of the false Web landmark, and then generating a false Web landmark with landmark characteristics but a false nominal position, a low delay relative to the protection target, and a high credibility according to the disguised entity, thereby realizing street-level IP anti-positioning, ensuring the rationality of the positioning result, and avoiding excessive offset of the positioning result.

[0008] In order to achieve the above object, the technical solution of the present invention is:

[0009] The first aspect of the present invention proposes an IP anti-location method based on false Web landmarks, comprising the following steps:

[0010] Step 1: Obtain the network topology of the area where the protected target is located to facilitate the setting of false Web landmarks;

[0011] Step 2: According to the network topology of the area where the protected target is located, set up at least one Web server under the router directly connected to the protected target to set up a false Web landmark;

[0012] Step 3: Determine the offset distance according to the size of the urban area where the protected target is located; the offset distance refers to the position deviation between the nominal position of the fake Web landmark to be constructed and the real geographical location of the Web server where it is located, which is convenient for misleading IP positioning and increasing the error of IP positioning;

[0013] Step 4: determining the nominal position range of the false Web landmark according to the offset distance, and determining at least one disguised entity required for the false Web landmark within the nominal position range of the false Web landmark, so as to obtain a suitable disguised entity;

[0014] Step 5: construct a false Web landmark based on the preset website template and the information of the disguised entity, and deploy the false Web landmark on the Web server; wherein, one disguised entity information corresponds to one false Web landmark, and one false Web landmark corresponds to one Web server, so as to resist IP positioning.

[0015] Furthermore, the offset distance is half of the radius of the city where the protected target is located, so as to generate a sufficient positioning error.

[0016] Furthermore, determining the nominal position range of the false Web landmark according to the offset distance specifically includes:

[0017] Taking the protected target position as the center and taking the preset distance ± the error threshold as the radius, a circle is determined; wherein the preset distance is determined according to the offset distance;

[0018] The network landmarks located in the ring are constructed into landmark subsets, and the network landmarks in the landmark subsets are clustered according to distance, and the coverage of all clusters is calculated;

[0019] The nominal location range of the false Web landmarks is obtained according to the coverage of the ring and all clusters, which makes it easier to find the appropriate entity.

[0020] Furthermore, clustering the network landmarks in the landmark subset according to distance specifically includes:

[0021] If the distance between two network landmarks is within the set distance, they are judged to belong to the same cluster;

[0022] If the first network landmark is in the same cluster as the second network landmark, and the first network landmark is in the same cluster as the third network landmark, then the second network landmark is in the same cluster as the third network landmark;

[0023] A single network landmark does not constitute a cluster.

[0024] Furthermore, the nominal position range of the false Web landmark is obtained according to the coverage range of the ring and all clusters, which is expressed by the following formula:

[0025]

[0026] Q x =∪S(L i ), L i ∈P x

[0027] Among them, A is the nominal location range of the false Web landmark, C is a circle with the protected target location as the center and the preset distance ± error threshold as the radius, ∪ is the union, Q x is the range covered by the xth cluster, S(L i ) is the range covered by the circle with the i-th network landmark as the center and the preset distance as the radius, ∩ is the intersection, L i is the i-th network landmark, P x is the xth cluster.

[0028] Furthermore, the step of determining at least one disguised entity required for the false Web landmark within the nominal position range of the false Web landmark specifically includes:

[0029] Determine the area with the most entities in the nominal location range of the fake Web landmark;

[0030] Count all entities in the region that do not have an official website and the types of all entities in the region, and sort them in descending order based on the number of types of all entities;

[0031] Among all entities that do not exist in the official website, a preset number of entities that match the top-ranked types are found and used as disguised entities of the false Web landmarks; one entity is found for each type; if a type does not have a matching entity, the next type is selected in the sorting order to determine the appropriate entity.

[0032] The second aspect of the present invention proposes an IP anti-location system based on false Web landmarks, comprising:

[0033] A collection module is used to obtain the network topology of the area where the protected target is located, so as to facilitate the setting of false Web landmarks;

[0034] A server setting module, used to set at least one Web server under a router directly connected to the protected target according to the network topology of the area where the protected target is located, for setting a false Web landmark;

[0035] An offset distance module is used to determine an offset distance according to the size of the urban area where the protected target is located; the offset distance refers to the position deviation between the nominal position of the fake Web landmark to be constructed and the real geographical location of the Web server where it is located, which is convenient for misleading IP positioning and increasing the error of IP positioning;

[0036] A nominal position range module of a false Web landmark, used to determine the nominal position range of the false Web landmark according to the offset distance, and to determine at least one disguised entity required for the false Web landmark in the nominal position range of the false Web landmark, so as to obtain a suitable disguised entity;

[0037] The false Web landmark webpage module is used to construct a false Web landmark based on a preset website template and the information of the disguised entity, and deploy the false Web landmark on the Web server; wherein, the information of a disguised entity corresponds to a false Web landmark, and a false Web landmark corresponds to a Web server, which is convenient for resisting IP positioning.

[0038] The third aspect of the present invention proposes an electronic device, comprising a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein when the processor executes the computer program, it implements an IP anti-location method based on false Web landmarks as described in the first aspect above.

[0039] The fourth aspect of the present invention proposes a computer-readable storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute an IP anti-location method based on false Web landmarks as described in the first aspect above.

[0040] Beneficial effects of the present invention:

[0041] (1) The present invention obtains the nominal position range of the false Web landmark by selecting a suitable offset distance, and selects a suitable entity in the nominal position range of the false Web landmark to construct the false Web landmark. Street-level IP anti-positioning is achieved. At the same time, since the positioning error is at the street level and the positioning error is within a suitable range, it can avoid attackers judging that the positioning result is wrong, thereby avoiding attracting additional attention from the attacker.

[0042] (2) The present invention deploys false Web landmarks to make the key positioning data of illegal locators produce errors, thus achieving a good anti-positioning effect. In an experiment with 156 landmarks as targets, the maximum target positioning error mean can be increased from 5.951km to 31.4km, and the median error can be increased from 3.779km to 31.8km when the position of the false Web landmark is offset by 20km. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 A schematic diagram of an IP anti-location method based on false Web landmarks provided in an embodiment of the present invention.

[0044] Figure 2 A flowchart of an IP anti-location method based on false Web landmarks provided in an embodiment of the present invention.

[0045] Figure 3 A flowchart of generating a false Web landmark provided by an embodiment of the present invention.

[0046] Figure 4 A schematic diagram of a normal positioning error provided by an embodiment of the present invention.

[0047] Figure 5 A schematic diagram of positioning error after generating a false Web landmark provided by an embodiment of the present invention.

[0048] Figure 6 A schematic diagram of the selection probability and the positioning error after generating a false Web landmark provided by an embodiment of the present invention.

[0049] Figure 7 An architectural diagram of an IP anti-location system based on false Web landmarks provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution in the embodiment of the present invention will be clearly described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is a part of the embodiment of the present invention, not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] Example 1

[0052] This embodiment explains some professional terms in the present invention.

[0053] Network landmarks (referred to as "landmarks") are the foundation and key elements of IP positioning technology based on network measurement. The landmark acquisition method based on web pages is one of the current mainstream landmark acquisition methods. The landmark acquisition method based on web pages mainly extracts geographic location, postal code, domain name, IP and other information from web pages through means such as Internet crawlers, associates IP addresses, web domain names with geographic locations, and thus constructs a mapping relationship from IP addresses to geographic locations to achieve landmark acquisition. In order to ensure the accuracy of the mapping relationship, this method usually adopts reliability assessment methods such as path measurement and reverse domain name query to eliminate inaccurate or erroneous mapping entries, and finally forms an accurate mapping relationship between IP addresses and geographic locations.

[0054] False Web landmarks refer to Internet websites and their IP addresses that have been tampered with or forged and are easily obtained through mainstream landmark acquisition methods, with false geographic locations marked on their homepages. The anti-geolocation method for network equipment based on the deployment of false Web landmarks aims to deploy false Web landmarks (hereinafter referred to as "false Web landmarks") in a concentrated manner near important protected targets, so that when illegal positioning parties use landmarks to locate protected targets, they will obtain incorrect landmark information and produce large positioning errors. Its basic principles are as follows: Figure 1 shown.

[0055] Since IP positioning methods based on high-precision landmarks often use the geographical location of landmark nodes with low latency to estimate the geographical location of the target device, when the deployed false Web landmarks have low latency with the target, the nominal geographical location of the false Web landmarks will become key information that misleads the illegal positioning party. As the core of the anti-positioning method, the false Web landmarks should have the characteristics of high credibility, easy to obtain through conventional Web landmark mining methods, low latency relative to the protected target, and good controllability.

[0056] A Web landmark is a website with an accurate nominal location, which is often attributed to a certain entity. Therefore, in the process of generating fake Web landmarks, issues such as the selection of the entity type claimed to belong to and the generation of basic website information are involved. At the same time, the generated fake Web landmarks should also have a high degree of credibility and be able to pass conventional landmark verification methods, so that the illegal positioning party has a high probability of believing that the fake Web landmark is an online website belonging to a certain entity, and use it as a landmark to participate in positioning, thereby achieving anti-positioning.

[0057] Landmarks obtained based on web pages are often called web landmarks, and fake web landmarks are referred to as fake landmarks. Different from web landmarks, fake web landmarks are web pages set up by device owners to protect their devices from being arbitrarily located by illegal locators. The function of fake web landmarks is to disguise themselves as normal web pages, waiting for the illegally located person to obtain them as network landmarks through landmark acquisition methods based on web pages to participate in positioning, and then use their own characteristics to interfere with positioning. In order to successfully interfere with illegal positioning behavior, fake web landmarks usually have the following characteristics:

[0058] False Web landmarks that meet the characteristics of Web landmarks should meet the basic characteristics of Web landmarks, including having a public IP, having accessible Web pages, and containing entity location information on the web pages (such as clearly marked in the form of "company address", etc.).

[0059] The nominal location information is wrong. In order to mislead illegal locators, the entity location information marked by the false Web landmark should have a certain gap with the actual geographical location of its server.

[0060] Easy to obtain. In order to ensure that false Web landmarks can participate in the positioning process with a greater probability and interfere with illegal positioning behavior, they should be easier to obtain through conventional Web landmark mining methods (such as Structon algorithm, etc.), that is, to cater to conventional Web landmark mining methods and meet their requirements for target Web pages.

[0061] High credibility: after being obtained by illegal locators through landmark mining, fake Web landmarks should be able to pass conventional landmark verification methods, allowing illegal locators to judge them as credible landmarks and participate in and interfere with IP positioning.

[0062] Good controllability: As a web page deployed on a specific server, the online time, quantity, response characteristics, etc. of the fake web landmark should be dynamically adjusted according to actual needs and network environment.

[0063] In summary, as a web page that meets the characteristics of a web landmark, a fake web landmark is easy to obtain through web landmark mining methods and has a high degree of credibility. At the same time, it is well controllable and convenient to manage.

[0064] Example 2

[0065] Based on the above embodiments, the present invention provides an IP anti-location method based on false Web landmarks, such as Figure 2 As shown, the following steps are included:

[0066] S101: Obtain the network topology of the area where the protected target is located.

[0067] Specifically, network measurements are performed on the area where the protected target is located. The protected target, surrounding landmarks, routes, etc. are measured using detection sources deployed in the city where the protected target is located to obtain the network topology of the area where the protected target is located.

[0068] S102: According to the network topology of the area where the protected target is located, at least one Web server is set under a router directly connected to the protected target.

[0069] Specifically, according to the network topology of the protected target area, at least one server is deployed under the directly connected router of the protected target for the deployment of the false Web landmark. The number of Web servers depends on the number of false Web landmarks to be deployed, and one false Web landmark corresponds to one Web server.

[0070] S103: used to determine the offset distance according to the size of the urban area where the protected target is located; the offset distance refers to the position deviation between the nominal position of the false Web landmark to be constructed and the real geographical location of the Web server where it is located.

[0071] Specifically, the nominal position of the false Web landmark is one of the decisive factors that cause network attackers to make large errors in IP positioning. In order to produce sufficient positioning errors, the nominal position of the false Web landmark should have a certain position deviation from the real geographical location of the Web server. The distance between the two is called the offset distance. If the offset distance is too small, it is difficult to produce sufficient positioning errors; if the offset distance is too large, the network attacker may notice that the positioning result is wrong. To avoid the above two situations, the offset distance between the nominal position of the false Web landmark and the real geographical location of the protected target is generally set to about 1 / 2 city radius, depending on the city where the protected target is located.

[0072] S104: Determine a nominal position range of the false Web landmark according to the offset distance, and determine at least one disguised entity required for the false Web landmark in the nominal position range of the false Web landmark.

[0073] Specifically, after determining the offset distance R of the false Web landmark, a circle C is determined with the protected target location as the center O and R±2.5km as the radius. The network landmarks located in the circle C are constructed as the landmark subset L sub , and L aub The network landmarks within are clustered by distance. The specific rules are as follows:

[0074] 1. Two network landmarks are considered to belong to the same cluster if the distance between them is within 1 km.

[0075] 2. If the network landmark L k With network landmark L j Same cluster, and network landmark Lk With network landmark L i In the same cluster, the network landmark L j With network landmark L i Same cluster.

[0076] 3. A single network landmark does not constitute a cluster.

[0077] After obtaining all network landmark clusters within the ring C, calculate the coverage of all clusters. x , and its coverage is expressed by the following formula:

[0078] Q x =∪S(L i ), L i ∈P x .

[0079] Among them, L i is the i-th network landmark, ∪ is the union, Q x is the range covered by the xth cluster, S(L i ) is the coverage of a circle with a radius of 1 km and the i-th network landmark as the center, P x is the xth cluster.

[0080] Then, the nominal location range of the false Web landmark can be obtained, which is expressed as follows:

[0081]

[0082] Among them, A is the nominal location range of the false Web landmark, C is a circle with the protected target location as the center and the offset distance ±2.5km as the radius, and ∩ is the intersection.

[0083] In the nominal location range A of the fake Web landmarks, the network landmarks are relatively sparse, which makes it difficult to effectively compare the detection data of the fake Web landmarks, and improves the credibility of the fake Web landmarks. Outside A, the network landmarks exist in clusters and are relatively densely distributed, that is, they have similar corresponding features and similar detection data. If the location of the fake Web landmark is nominally located at the location Q of a cluster, x In the process, since the measurement data characteristics of the fake Web landmarks are too different from those of the network landmarks in the cluster, it is very easy for network attackers to determine that the data is wrong or abnormal, and then eliminate the detection data of the fake Web landmarks, causing anti-localization to fail.

[0084] Determine the area with the most entities in the nominal location range of the fake Web landmark. Count all entities in the area that do not have an official website and the types of all entities in the area, and sort all entities in descending order according to the number of types. Among all entities that do not have an official website, find a preset number of entities that match the top-ranked types and use them as disguised entities of the fake Web landmark. Among them, one entity is found for each type. If there is no matching entity for a type, it will be postponed to the next type in the sorting order.

[0085] S105: constructing a false Web landmark according to a preset website template and information of the disguised entity, and deploying the false Web landmark on the Web server; wherein one piece of information of a disguised entity corresponds to one false Web landmark, and one false Web landmark corresponds to one Web server.

[0086] Specifically, crawl the website template of the same type as the disguised entity, and create a false Web landmark based on the disguised entity and the website template, and deploy it on the set Web server.

[0087] The present invention first sets at least one Web server under the router directly connected to the protected target according to the network topology of the area where the protected target is located, and determines the offset distance according to the size of the urban area where the protected target is located. Then, the nominal location range of the false Web landmark is determined by the offset distance, and at least one disguised entity required for the false Web landmark is determined in the nominal location range of the false Web landmark. Finally, a false Web landmark is constructed according to the disguised entity and a preset website template, and the false Web landmark is deployed on the Web server. The present invention successfully increases the error of the street-level IP positioning method. At the same time, because the error is at the street level, it can prevent attackers from making incorrect judgments through database queries.

[0088] Example 3

[0089] Based on the above embodiments, the present invention proposes a specific process of determining at least one disguised entity required for a false Web landmark according to the nominal location range of the false Web landmark and constructing a false Web landmark according to a preset website template and information of the disguised entity:

[0090] Specifically, in order to make the fake Web landmark more credible, the fake Web landmark is disguised as a Web page of an entity within the nominal location range A of the fake Web landmark. By crawling local enterprise statistical information and querying online maps and the list of publicly registered enterprises of local government departments, the distribution of entities within the nominal location range A of the fake Web landmark is counted, and the area with the most entities in the nominal location range A of the fake Web landmark is determined (such as a commercial street, an industrial area, etc.). Then, the crawled entity information is screened, and the entity information without official web pages in the area is collected, and the entities without official web pages are used as candidate disguised entities for the fake Web landmark.

[0091] For example, the crawled entity information shows that the number of entities on a certain street s is the largest within the nominal location range A of the false Web landmark, and the information shows that n of the entities do not have an official website. In this case, detailed information (such as name, address, zip code, telephone number, etc.) of the above n entities are collected and used as alternative disguised entities for the false Web landmark.

[0092] Count the number of different types of entities in street s, and sort them in descending order according to the number of entity types. Among the n candidate disguised entities, find the three entities that meet the top 3 (if not, postpone them) and their corresponding information, and use these three entities as disguised entities. Then, crawl the same type of websites as templates for building fake Web landmark websites, so that the fake Web landmark websites are more in line with the actual websites of related industries.

[0093] For example, the number of entity types in street s is ranked as school, construction company, hardware company, etc. Find one entity that matches the above three entity types and its corresponding information among the n candidate disguised entities. If a certain type of entity does not exist, find the entity that matches the next ranking type and its corresponding information. Then, crawl the same type of website as a template for building a fake Web landmark website.

[0094] According to the crawled web page template and the corresponding disguised entity information, a fake web landmark web page is created. The disguised entity information is slightly modified, such as changing the entity name from a certain primary school in City A to a certain middle school in District B of City A. Then the corresponding content in the template web page is replaced with the slightly modified disguised entity information to obtain a fake web landmark web page. After obtaining the generated fake web landmark, it is deployed on the deployed web server.

[0095] So far, three false Web landmarks with similar nominal locations (all located in street s) and similar measurement data (directly connected to the same router) have been obtained. The false Web landmarks have real physical objects and professional website pages. To further improve the anti-positioning effect, more false Web landmarks can be deployed, and more Web servers can be deployed accordingly. The above false Web landmark generation process is as follows: Figure 3 shown.

[0096] Example 4

[0097] On the basis of the above-mentioned embodiments, the present invention proposes a verification and analysis method for an IP anti-location method based on false Web landmarks.

[0098] In order to verify the anti-positioning effect of the present invention in a real network environment, some landmarks in city G were selected as protection targets. Multiple detection sources were used to perform multiple network measurements on the target and its surrounding landmarks to obtain detection data. The classic high-precision positioning algorithm SLG was used to locate the protection target, and the changes in positioning errors before and after anti-positioning were compared.

[0099] First, 156 landmarks in city G were positioned as targets. The positioning results are as follows: Figure 4 As shown in the figure, the mean error is 5.951km and the median is 3.779km. The smaller median value shows that quite a lot of network devices can be accurately located. Although they do not publish their geographic locations and do not use remote positioning technology (such as GPS, Beidou system, etc.), they can still be located at the street level by illegal locators, exposing their geographic location privacy.

[0100] Then, the false Web landmarks are generated by the present invention, and the false Web landmarks are placed under the router directly connected to the target, and the offset distance is set to 20km. The 156 targets are located one by one, and the mean, median and maximum values ​​of the errors in each round of positioning are calculated, and the results are obtained by repeating 6 times. Figure 5 shown.

[0101] In the six experiments, the fake Web landmarks were placed on different servers, twice on servers that were closer to the target direct route (corresponding to the first and second experiments), twice on servers that were farther away (corresponding to the third and fourth experiments), and on the same server as the target (corresponding to the fifth and sixth experiments).

[0102] The experimental results show that when the false Web landmark is placed on a server far away from the target direct route, the mean and median of the positioning error only increase slightly, and the maximum error value even decreases. When the false Web landmark is placed on a server close to the target direct route, the anti-positioning effect is more significant, and the mean, median and maximum values ​​are greatly improved. When the false Web landmark and the target are placed on the same server, the anti-positioning effect is intermediate. After analysis, it is known that the IP positioning algorithm based on high-precision landmarks mainly uses landmarks with relatively low delays to the target for positioning. Therefore, when choosing to place false Web landmarks on different servers, it actually changes the relative delay between the false Web landmark and the target. When the relative delay between the false Web landmark and the target is too large, the positioning algorithm will use other landmarks instead of false Web landmarks to infer the location of the target, which will cause the anti-positioning to fail.

[0103] In order to verify the conclusion, the selection probability p of the false Web landmarks corresponding to the six experiments is calculated respectively, which is referred to as the selection probability, as follows: Figure 6 As shown. The selection probability p is defined as: in the process of positioning all targets, the percentage of the location of the false Web landmarks used by the positioning algorithm as the main positioning data. For the SLG algorithm, the selection probability p can also be equivalent to the percentage of the targets in the positioning results that use the nominal location of the false Web landmarks as the estimated location, which accounts for the total number of targets. After calculation, the selection probability p is shown in Table 1:

[0104] Table 1. The selection probability and average positioning error of false Web landmarks corresponding to 6 experiments

[0105]

[0106] By matching the selection probability p with the positioning results of the corresponding round, it can be found that when the false Web landmarks have the same offset distance, the anti-positioning effect is significantly more significant in the experimental rounds with a larger selection probability p, and the size of the selection probability p is significantly positively correlated with the anti-positioning effect. In the first two rounds of experiments, the false Web landmarks were deployed to servers far away from the target direct route, which increased the relative delay between the false Web landmarks and the target, thereby reducing the selection probability p, resulting in poor anti-positioning effect. In the third and fourth experiments, on the contrary, due to the higher selection probability p, the anti-positioning effect was significantly improved. In the last two experiments, since the false Web landmarks and the target were on the same server, the relative delay between the two was in the middle compared to the first two cases.

[0107] In summary, the present invention deploys false Web landmarks to cause errors in the key positioning data of illegal locators, thereby achieving good anti-positioning effect.

[0108] Preferably, in order to achieve better anti-positioning effect, the false Web landmark can be deployed on a server that is closer to the protected target through a direct route, so that the relative delay between the false Web landmark and the protected target is small, thereby achieving a good anti-positioning effect.

[0109] Example 5

[0110] Based on the above embodiments, the present invention proposes an IP anti-location system based on false Web landmarks corresponding to the above method, such as Figure 7 As shown, including:

[0111] A collection module, used to obtain the network topology of the area where the protected target is located;

[0112] A server setting module, used to set at least one Web server under a router directly connected to the protected target according to the network topology of the area where the protected target is located;

[0113] An offset distance module is used to determine an offset distance according to the size of the urban area where the protected target is located; the offset distance refers to the position deviation between the nominal position of the false Web landmark to be constructed and the real geographical location of the Web server where it is located;

[0114] A nominal position range module of a false Web landmark, used to determine a nominal position range of the false Web landmark according to the offset distance, and to determine at least one disguised entity required for the false Web landmark in the nominal position range of the false Web landmark;

[0115] The false Web landmark webpage module is used to construct a false Web landmark according to a preset website template and information of a disguised entity, and deploy the false Web landmark on the Web server; wherein, one disguised entity information corresponds to one false Web landmark, and one false Web landmark corresponds to one Web server.

[0116] It should be noted that the IP anti-location system based on false Web landmarks provided in an embodiment of the present invention is for realizing the above-mentioned IP anti-location method based on false Web landmarks. Its specific functions can be referred to the above-mentioned method embodiments and will not be repeated here.

[0117] Example 6

[0118] Based on the above embodiments, the present invention proposes an electronic device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements an IP anti-location method based on false Web landmarks as in the above embodiments.

[0119] The present invention proposes a computer-readable storage medium, which includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute an IP anti-location method based on false Web landmarks as in the above-mentioned embodiment.

[0120] In summary, the present invention obtains the nominal position range of the false Web landmark by selecting a suitable offset distance, and obtains the false Web landmark by selecting a suitable entity in the nominal position range of the false Web landmark. Street-level IP anti-positioning is achieved. At the same time, because the positioning error is at the street level and the positioning error is within a suitable range, it can avoid attackers from judging that the positioning result is wrong, thereby avoiding attracting additional attention from attackers. The present invention achieves a good anti-positioning effect by deploying false Web landmarks, so that the key positioning data of illegal locators will produce errors. In an experiment with 156 landmarks as targets, the street-level IP positioning method can be countered. When the position of the false Web landmark is offset by 20km, the maximum target positioning error mean can be increased from 5.951km to 31.4km, and the median error is increased from 3.779km to 31.8km.

[0121] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An IP anti-location method based on false Web landmarks, characterized in that: The following steps are involved: Step 1: Obtain the network topology of the area where the protected target is located; Step 2: According to the network topology of the area where the protected target is located, set up at least one Web server under the router directly connected to the protected target; Step 3: Determine the offset distance according to the size of the urban area where the protected target is located; the offset distance refers to the position deviation between the nominal position of the fake Web landmark to be constructed and the real geographical location of the Web server where it is located; Step 4: determining the nominal position range of the false Web landmark according to the offset distance, and determining at least one disguised entity required for the false Web landmark in the nominal position range of the false Web landmark; Step 5: construct a false Web landmark based on the preset website template and the information of the disguised entity, and deploy the false Web landmark on the Web server; wherein, one piece of information of a disguised entity corresponds to one false Web landmark, and one false Web landmark corresponds to one Web server.

2. According to claim 1, a method for IP anti-location based on false Web landmarks is characterized in that: The offset distance is half of the radius of the city where the protected target is located.

3. The method for IP anti-location based on false Web landmarks according to claim 1, characterized in that: Determining the nominal position range of the false Web landmark according to the offset distance specifically includes: Taking the protected target position as the center and taking the preset distance ± the error threshold as the radius, a circle is determined; wherein the preset distance is determined according to the offset distance; The network landmarks located in the ring are constructed into landmark subsets, and the network landmarks in the landmark subsets are clustered according to distance, and the coverage of all clusters is calculated; The nominal location range of the false Web landmarks is obtained based on the coverage of the ring and all clusters.

4. The method for IP anti-location based on false Web landmarks according to claim 3, characterized in that: The clustering of network landmarks in the landmark subset according to distance specifically includes: If the distance between two network landmarks is within the set distance, they are judged to belong to the same cluster; If the first network landmark is in the same cluster as the second network landmark, and the first network landmark is in the same cluster as the third network landmark, then the second network landmark is in the same cluster as the third network landmark; A single network landmark does not constitute a cluster.

5. The method for IP anti-location based on false Web landmarks according to claim 3, characterized in that: The nominal position range of the false Web landmark is obtained according to the coverage of the ring and all clusters, which is expressed by the following formula: Q x =∪S(L i ),L i ∈P x Among them, A is the nominal location range of the false Web landmark, C is a circle with the protected target location as the center and the preset distance ± error threshold as the radius, ∪ is the union, Q x is the range covered by the xth cluster, S(L i ) is the range covered by the circle with the i-th network landmark as the center and the preset distance as the radius, ∩ is the intersection, L i is the i-th network landmark, P x is the xth cluster.

6. The method for IP anti-location based on false Web landmarks according to claim 1, characterized in that: The step of determining at least one disguised entity required for the false Web landmark within the nominal position range of the false Web landmark specifically includes: Determine the area with the most entities in the nominal location range of the fake Web landmark; Count all entities in the region that do not have an official website and the types of all entities in the region, and sort them in descending order based on the number of types of all entities; Among all entities that do not exist in the official website, find a preset number of entities that match the top-ranked types and use them as disguised entities of the false Web landmarks; one entity is found for each type; if a type does not have a matching entity, then move on to the next type in the sorting order.

7. An IP anti-location system based on false Web landmarks, characterized in that: include: A collection module, used to obtain the network topology of the area where the protected target is located; A server setting module, used to set at least one Web server under a router directly connected to the protected target according to the network topology of the area where the protected target is located; An offset distance module is used to determine an offset distance according to the size of the urban area where the protected target is located; the offset distance refers to the position deviation between the nominal position of the false Web landmark to be constructed and the real geographical location of the Web server where it is located; A nominal position range module of a false Web landmark, used to determine a nominal position range of the false Web landmark according to the offset distance, and to determine at least one disguised entity required for the false Web landmark in the nominal position range of the false Web landmark; The false Web landmark webpage module is used to construct a false Web landmark according to a preset website template and information of a disguised entity, and deploy the false Web landmark on the Web server; wherein, one disguised entity information corresponds to one false Web landmark, and one false Web landmark corresponds to one Web server.

8. An electronic device, characterized in that: It includes a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor. When the processor executes the computer program, it implements an IP anti-location method based on false Web landmarks as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The storage medium includes a stored computer program, wherein when the computer program is running, the device where the storage medium is located is controlled to execute an IP anti-location method based on false Web landmarks as described in any one of claims 1 to 6.

Images