Out-of-distribution generalization IP geolocation method based on invariant learning

Abstract

The present invention discloses an out-of-distribution generalized IP geolocation method based on invariant learning, relates to the field of IP positioning technology, and reveals the invariant structure in the IP graph under different environments, so as to improve the generalization ability of IP geolocation in the presence of out-of-distribution data. First, the original routing data is preprocessed into an IP graph that can be processed by a deep model for use in downstream structures; then, an invariant extractor is used to extract the invariant features and invariant topological structure of the IP graph to predict the longitude and latitude of the target IP; on this basis, by utilizing the random combination of invariant components and shortcut components, various environmental conditions are effectively simulated to predict the longitude and latitude of the target IP, thereby ensuring the effectiveness of the invariant extractor; finally, regularization terms for feature, topological structure, and parameter updates are applied to model training to increase the generalization ability of the model. A new standard is set for the accuracy of IP geolocation under distribution changes, which can enhance the reliability and scalability of IP geolocation in real applications.

Description

Technical Field

[0001] The present invention relates to the technical field of IP positioning, and more specifically to a distribution out-generalization IP geographic positioning method based on invariant learning. Background Art

[0002] As the Internet continues to grow, the need for accurate IP geolocation is becoming increasingly important for location-aware applications that rely on precise user geolocation data to provide personalized services such as region-specific advertising recommendations, behavioral analysis across different geographic regions, and cybercrime tracking. However, the challenges of obtaining accurate user geolocation data are significant due to its sensitivity and unavailability. In addition, the proliferation of mobile devices that constantly move across networks further complicates the task of achieving accurate IP geolocation, highlighting the urgent need for advanced models that can overcome these limitations.

[0003] Current IP geolocation technologies only work well when the training set and the test set have similar distributions. They do not have the ability to handle out-of-distribution data. These methods often fail to achieve ideal geolocation results when deployed in practice because distribution changes are widely present in actual application scenarios. Therefore, in actual application scenarios, a model with out-of-distribution generalization capabilities is more needed.

[0004] Early IP geolocation systems usually rely on network mining technology to analyze various Internet data, such as WHOIS database, web page content and user registration records. For example, the login records containing location information voluntarily shared by users on social networks are combined with user login logs to establish the correspondence between IP addresses and geographic locations. However, network mining methods face the limitations of unreliable and incomplete data because they passively collect network information, which can easily lead to inaccurate geolocation.

[0005] To address the challenges associated with network mining, many IP geolocation method studies use active measurements to obtain accurate IP geolocation. The principle guiding these methods is that there is a positive correlation between network delay and geographic distance. For example, a small number of detection hosts are controlled to ping the target IP, calculate its delay vector, and then locate the landmark by calculating the similarity between this vector and the known landmark vector. However, these methods rely too much on the delay distance assumption, which may not hold true in actual scenarios. In addition, due to network fluctuations and congestion, the relationship between network measurements and geographic distance is dynamically changing and difficult to estimate, which greatly affects the effect of IP geolocation.

[0006] In recent years, machine learning and deep learning techniques have gained considerable popularity in the field of IP geolocation. With the continuous development of graph neural networks, more and more studies have applied this technology to IP geolocation. These methods redefine IP geolocation as a property graph node regression problem and design a graph neural network-based framework to utilize the surrounding knowledge of the target IP host. Although the IP geolocation method based on graph neural networks has achieved great improvements in accuracy and takes into account factors such as uncertainty, robustness, and interpretability.

[0007] However, the above technical solutions fail to solve a key problem: the widespread distribution migration problem. This limits their applicability in real-world scenarios, as data from different regions often vary greatly. Without customized solutions to handle distribution changes, these models cannot reliably operate in different and unseen locations—a basic function of real-world IP geolocation.

[0008] Therefore, it is necessary to propose a distribution-generalized IP geolocation method based on invariant learning to solve the above problems. Summary of the invention

[0009] The purpose of the present invention is to solve the problems mentioned in the background technology.

[0010] In order to achieve the above-mentioned purpose, the present invention specifically adopts the following technical solutions:

[0011] The out-of-distribution generalization IP geolocation method based on invariant learning includes the following steps:

[0012] Step 1: Represent the IP graph as G = (A, X), where A is the adjacency matrix, X = [X a , X m ] is the attribute data X a and measurement data X m combination of;

[0013] Step 2: Assume there are m landmarks in the IP graph and n target nodes Update the target node information through the graph neural network to predict the target's longitude and latitude;

[0014] Step 3: Aggregate the latitude and longitude information of the landmarks, obtain the normalized attention coefficient, and output the features of each target node:

[0015]

[0016] Where: l i Indicates the target IP address. Represents all landmarks in the IP graph, Yes i Neighbor, y j is the real latitude and longitude of the landmark;

[0017] Step 4: Split the extractor Φ(·) into two parts: node feature extractor Φ x (·) and the topology extractor Φ a (·), for node features, use feature masks To extract the invariant features X inv :

[0018] X inv =X⊙M x , M x =Φ x (X),

[0019] Among them: ⊙ represents the element-by-element product;

[0020] For the graph topology, use the topology mask to filter out useless landmarks and obtain the unchanged graph topology A inv :

[0021] A inv =A⊙M a , M a =Φ a (A);

[0022] Use Gumbel-Sigmoid reparameterization to replace M x and M a ;

[0023] Step 5: For the graph topology, discard the noise nodes that are useless for prediction and reduce the prediction effect, and only use the landmarks that are helpful for predicting the target, that is, A inv As the adjacency matrix, for node features, through the node feature extractor Φ X (·) Get the invariant feature X inv and shortcut feature X s =XX inv , hybrid features are generated through environment-agnostic strategies, expressed as:

[0024]

[0025] Where: X′ s Yes X s The disrupted order, A mixed feature set that represents the sum of the invariant component of a node and the shortcut component of any other node;

[0026] Step 6: Mix the feature set With the unchanged adjacency matrix Ainv Input them into the model together to get the second loss function:

[0027]

[0028] Step 7: Regularize node features, topology structure, and parameters to maintain the desired properties of the IP graph, and update model parameters by optimizing the target to obtain an IP geolocation model with out-of-distribution generalization capability.

[0029] Furthermore, the adjacency matrix defined in step 2 is: when i∈{0, 1, ..., m-1} and j∈{m, m+1, ..., n-1}, A ij =1, otherwise set to 0;

[0030] The structure of the corrected adjacency matrix is ​​as follows:

[0031]

[0032] Furthermore, the re-parameterization method in step 4 is as follows:

[0033]

[0034] Among them: σ(·) is the Sigmoid function, ∈~Uniform(0,1) obeys uniform distribution, τ is the temperature, when the temperature coefficient is low, the sampling process can be approximated as Bernoulli sampling, and the edge sharp mask is obtained. When the temperature coefficient is high, it is interpreted as a probabilistic selection, which means that the model's selection of specific features is not absolute, but has a certain weight or uncertainty. After obtaining the invariant component and the shortcut component, the loss function is:

[0035]

[0036] For the above formula, we derive a tractable variational upper bound:

[0037]

[0038] Where: H(Y) is a constant, and P θ (Y|Φ(G e ))The θ in it is f θ θ in, rewrite the loss function as:

[0039]

[0040] in: is the number of target nodes in graph G, represents the prediction regression loss of the target-centered ego-graph. Note that X and A represent the features and adjacency matrix of the target-centered ego-graph.

[0041] Furthermore, before aggregating the latitude and longitude information of the landmarks in step 3, the shared linear transformation Applied to each node Calculate the attention coefficient:

[0042]

[0043] Furthermore, the node feature regularization method in step 7 is as follows:

[0044] In the feature mask M x The l1 norm is added as a regularization term to impose a constraint on the size, which is defined as:

[0045] R1=||M x ||1.

[0046] Furthermore, the topological structure regularization method in step 7 is as follows:

[0047] A random attention mechanism is used to extract high-quality IP graph structures. Another regularization term on topology is defined as:

[0048] R2=KL(P(M a |X)||Q(M a )),

[0049] Where: P(M a |X) is the posterior Bernoulli distribution of the edge, Q(M a ) is the prior Bernoulli distribution of the edge with parameter r, simplifying the KL divergence between the two Bernoulli distributions and rewriting R2 as:

[0050]

[0051] Where: E represents the set of edges, π uv Represents the probability of edge (u, v) being sampled.

[0052] Furthermore, the parameter regularization method in step 7 is as follows:

[0053] Introducing 12 regularization into the parameters reduces the risk of overfitting during training and makes the model more adaptable to unseen data, expressed as:

[0054]

[0055] Furthermore, the optimization objective in step 7 can be defined as:

[0056]

[0057] Among them: λ1, λ2 and λ3 are node characteristics, topological structures and parameter regularization coefficients respectively.

[0058] Compared with the prior art, the present invention has the following beneficial effects:

[0059] 1. This paper solves the out-of-distribution generalization problem in IP geolocation: This paper first identifies, formulates, and critically solves the out-of-distribution generalization problem in IP geolocation. This groundbreaking work lays the foundation for exploring more powerful solutions that go beyond the traditional, narrow assumption of data consistency.

[0060] 2. This paper introduces a new graph-invariant learning method for IP geolocation, called GILGeo, which learns invariant relationships from the perspective of features and topology under distribution changes. By capturing stable, context-invariant relationships in the data, the model's ability to generalize across different regions and conditions is improved.

[0061] 3. We validate the effectiveness of GILGeo through comprehensive experiments on three real datasets. The results show that GILGeo significantly improves accuracy on unseen out-of-distribution datasets, emphasizing its effectiveness under distribution shift conditions. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 Schematic diagram of the IP geolocation model, describing the invariant component extraction process and the IP geolocation task.

[0063] Figure 2 Partitioning of out-of-distribution datasets for IP geolocation tasks.

[0064] Figure 3 Performance of IP geolocation model on real datasets. DETAILED DESCRIPTION

[0065] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0066] See also Figure 1-Figure 3Out-of-distribution generalization refers to the ability of a machine learning model to maintain good performance when the data distribution used during training is different from the data distribution encountered during testing. Typically, traditional machine learning models rely on the training data and test data sharing the same distribution (i.e., independent and identically distributed assumption). However, in real-world scenarios, the distribution of test data often deviates from the training distribution due to data collection methods, environmental changes, or other factors, resulting in out-of-distribution problems. Its theoretical basis can be found in the literature [Hendrycks D, Basart S, Mu N, et a1. The many faces of robustness: A critical analysis of out-of-distribution generalization [C] / / Proceedings of the IEEE / CVF international conference on computer vision. 2021: 8340-8349.]

[0067] Invariant learning is a method in machine learning that aims to learn features or rules from data that can remain stable in different environments (domains), thereby improving the generalization ability of the model in out-of-distribution scenarios. In many real-world tasks, data often comes from multiple environments (such as different times, places, conditions, etc.), which may affect the distribution of data. Traditional machine learning models tend to capture spurious correlations in specific environments. These features may perform well in the training environment, but will cause the model performance to degrade significantly in out-of-distribution environments. The core goal of invariant learning is to find causal features or rules that are consistent across environments to ensure that the model can also perform stably in unknown environments. Its theoretical basis can be found in the literature [Arjovsky M, Bottou L, Gulrajani I, et a1. Invariant risk minimization [J]. arXiv preprint arXiv: 1907.02893, 2019.]

[0068] In order to clearly explain the generalization problem of graph-based IP geolocation tasks, we first define the traditional IP geolocation task and then introduce the generalization problem of graph-based IP geolocation tasks.

[0069] 1. IP geolocation task

[0070] The geolocation task is defined using a set of reference hosts with known geographic locations (also known as landmarks). Given a set of hosts with relevant properties Landmarks Its network measurement value is The location specified by longitude and latitude is The main goal of machine learning-based IP geolocation methods is to transform known information into and To locate unknown IP addresses:

[0071]

[0072] in is the predicted geographic location of the target IP, and θ is a learnable model parameter.

[0073] 2. Generalization Problem of Graph-based IP Geolocation

[0074] First, the IP graph is constructed using a graph composition algorithm. Specifically, the last-hop routing delay corresponding to each IP node is found in the routing data collected by four different probes, and the shortest delay and corresponding router are selected from the four last-hop routing delays. Then, the two nodes with the same last-hop router are put into the same IP graph to obtain the initial IP graph. In each initial IP graph, there are an indefinite number of landmarks and target IP nodes, which are adjacent to each other (landmarks and target IP nodes are not adjacent). For target IPs with less than or equal to 10 adjacent nodes, the two smallest last-hop delays are used to reconstruct the IP graph to alleviate the sparsity problem.

[0075] This paper mainly focuses on the distribution out-generalization problem in IP geolocation, assuming that the distribution of the training set and the test set are different For better understanding, we use e to represent the random variable of the environment that affects the data distribution. Therefore, the IP graph can be reformulated as where ∈ all Represents the value set of e. Training data set and test dataset There is usually a large distribution difference between them. The goal is to use the observed training IP graph Train an optimal model f * , the distribution change ∈ caused by the model in the environment tr ≠∈ test Under this condition, it can generalize well to unobserved test data sets. Formally, the out-of-distribution generalization objective can be written as:

[0076]

[0077] Where G e represents the distribution of G in the e environment, I(·;·) represents the mutual information, and Y represents the latitude and longitude of the target IP. The above objectives require not only maximizing the global mutual information, but also optimizing the worst case as much as possible to improve the generalization of the distribution.

[0078] The present invention includes three main modules: (1) Lightweight Graph Attention Neural Network (LightGAT), (2) Invariant Subgraph Extractor, and (3) Invariant Learning. For the graph-based IP geolocation task, the present invention first introduces LightGAT, which produces better results while improving computational efficiency. Next, an invariant subgraph extractor module is designed to identify invariant components in complex IP graphs, where the correlation between these components and target labels remains stable. At the same time, the invariant learning module ensures the effective extraction of these invariant components and obtains accurate geolocation results under distribution changes. Finally, the present invention introduces regularization terms from three aspects: features, topological structure, and parameter update to improve the generalization ability of the model.

[0079] The present invention first introduces LightGAT, which produces better results while improving computational efficiency.

[0080] Next, an invariant subgraph extractor module is designed to identify invariant components in complex IP graphs, where the correlations between these components and target labels remain stable.

[0081] At the same time, the invariant learning module ensures the effective extraction of these invariant components, obtaining accurate geolocation results despite distribution changes.

[0082] Finally, the present invention introduces regularization terms from three aspects: features, topological structure and parameter updating to improve the generalization ability of the model.

[0083] 1. LightGAT

[0084] The IP graph is represented as G = (A, X), where A is the adjacency matrix and X = [X a , X m ] is the attribute data X a and measurement data X m Assume that there are m landmarks in the graph and n target nodes Considering that the goal is to use landmark information to predict the latitude and longitude of the target, only the information of the target node needs to be updated in the graph neural network. Therefore, the adjacency matrix is ​​defined as: when i∈{0, 1,…, m-1} and j∈{m, m+1,…, n-1}, A ij=1, otherwise it is set to 0. More formally, the structure of the adjacency matrix is ​​as follows:

[0085]

[0086] Note that the target IP aggregates the information of all landmarks and updates them when passing through the graph neural network, while the landmark information remains unchanged.

[0087] In deep learning, models with large parameter sizes tend to overfit and perform poorly on out-of-distribution datasets. To address this problem, the structure of the attention neural network (GAT) is simplified and LightGAT is proposed as an encoder for the IP geolocation task. In order to obtain sufficient expressive power to transform the input features into higher-level features, at least one learnable linear transformation is required. To this end, as an initial step, a shared linear transformation Applied to each node First calculate the attention coefficient:

[0088]

[0089] Since the goal is to predict the latitude and longitude of the target, only the latitude and longitude information of the landmarks needs to be aggregated to achieve this goal and reduce the computational cost. Once the normalized attention coefficients are obtained, the features of each target are output:

[0090]

[0091] in (i.e. all landmarks in the IP map) are l i Neighbor of (target IP), y j It is the real latitude and longitude of the landmark.

[0092] 2. Invariant Subgraph Extractor

[0093] Considering that the structure of IP graph G = (A, X) is different from that of Euclidean data, it is necessary to learn not only the invariance of node features X, but also the invariance of topology A. Therefore, the extractor Φ(·) is split into two parts: feature extractor Φ x (·) and the topology extractor Φ a (·). For node features, a feature mask is used To extract the invariant features X inv :

[0094] X inv =X⊙M x , M x =Φ x (X),

[0095] Where v represents the element-by-element product. For the graph topology, the topology mask is used to filter out useless landmarks and obtain the unchanged graph topology A. inv :

[0096] A inv =A⊙M a , M a =Φ a (A).

[0097] Intuitively, the more important a feature or edge is, the larger its weight is. In this work, all possible features and edges are modeled as a set of independent Bernoulli random variables parameterized by learned weights π. A problem is M(M x and M a ) is not differentiable with respect to π when sampling, so we use the Gumbel-Sigmoid reparameterization trick instead, as follows:

[0098]

[0099] σ(·) is the Sigmoid function, ∈~Uniform(0,1) obeys uniform distribution, and τ is the temperature. When the temperature coefficient is low, the sampling process can be approximated as Bernoulli sampling, and a sharp edge mask is obtained. When the temperature coefficient is high, it is interpreted as a probabilistic selection, which means that the model's selection of a specific feature is not absolute, but has a certain weight or uncertainty. After obtaining the invariant component and the shortcut component, the loss function can be written as:

[0100]

[0101] For the above formula, we derive a tractable variational upper bound:

[0102]

[0103] where H(Y) is a constant. And, P θ (Y|Φ(G e ))The θ in it is f θ In θ, the loss function can be rewritten as:

[0104]

[0105] in is the number of target nodes in graph G, represents the prediction regression loss of the target-centered ego-graph. Note that X and A represent the features and adjacency matrix of the target-centered ego-graph.

[0106] 3. Invariant Learning

[0107] During training, we only have access to data from a limited environment and no access to the test dataset. The desired invariant part cannot be extracted by the above steps alone. Due to the lack of data from the test environment, the model can still tolerate shortcut components that are easier to fit. In addition, there is no information like environment labels to assist the model in identifying spurious correlations.

[0108] To this end, a strategy that is independent of the environment is proposed. Specifically, an extractor Φ(·) is used to distinguish the invariant components and shortcut components in the node features and graph topology. For the graph topology, those noise nodes that are useless for prediction or even reduce the prediction effect will be discarded, and only the landmarks that are helpful for predicting the target will be used, namely A inv As an adjacency matrix. For node features, through the node feature extractor Φ X (·) Get the invariant feature X inv and shortcut feature X s =XX inv The hybrid features generated by the environment-agnostic strategy are expressed as:

[0109]

[0110] where X′ s By disrupting X s obtained in the order of . The sum of the invariant component of the node and the shortcut component of any other node is mixed into the feature set With the unchanged adjacency matrix A inv Input into the model together. Therefore, the second loss function can be obtained:

[0111]

[0112] 4. Regularization Techniques

[0113] Finally, various regularization terms are used to maintain the desired properties of the IP graph in order to achieve better performance in out-of-distribution generalization. Below, the regularization terms and their principles are discussed.

[0114] (1) Feature regularization. In order to obtain compact and concise features, x The l1 norm is added as a regularization term to impose a constraint on the size. This is defined as:

[0115] R1=||Mx||1.

[0116] (2) Topological structure regularization. In order to reduce the impact of noise nodes on geolocation performance, a random attention mechanism is used to extract high-quality IP graph structures. Another regularization term for topology is defined as:

[0117] R2=KL(P(Ma |x)||Q(M a )),

[0118] Where P(M a |X) is the posterior Bernoulli distribution of the edge, Q(M a ) is the prior Bernoulli distribution of the edge with parameter r. We simplify the KL divergence between the two Bernoulli distributions and rewrite R2 as:

[0119]

[0120] Where E represents the set of edges, π uv Represents the probability of edge (u, v) being sampled.

[0121] (3) Parameter regularization. In order to improve the generalization ability of the model, l2 regularization is introduced in the parameters. This regularization can reduce the risk of overfitting during training and make the model more adaptable to unseen data. It can be expressed as:

[0122]

[0123] Finally, the optimization goal of GILGeo can be defined as:

[0124]

[0125] Where λ1, λ2 and λ3 are regularization coefficients respectively.

[0126] Application Examples

[0127] 1. Training set and test set division

[0128] To evaluate the algorithm, experiments were conducted on real IP geolocation datasets in three major cities, New York, Los Angeles, and Shanghai. The datasets are from the reference [Wang Z, Zhou F, Zeng W, et a1. Connecting the hosts: Street-level ip geolocation with graph neural networks [C] / / Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and DataMining. 2022: 4121-4131.]. These datasets contain 91808, 92804, and 126258 IP addresses, respectively. In order to adapt to the out-of-distribution scenarios discussed in this paper, each dataset is divided into two parts according to longitude and latitude. One part is used for training and validation, while the other part is used as an out-of-distribution dataset to evaluate the generalization ability of the model. Specifically, the K-means clustering algorithm is applied to divide all nodes into two different clusters. As shown in the figure, the map is divided into fine-grained grids, with grid cells containing nodes highlighted in blue or red. The red grids represent nodes used for training and validation, while the blue grids contain nodes for evaluating generalization performance. This division method can intuitively observe the differences in the longitude and latitude distribution of the two datasets, thereby gaining in-depth insights into the uniqueness of the three datasets. In each dataset, 70% of the IP points are designated as landmarks, and the remaining 30% are designated as target IPs to be predicted.

[0129] 2. Evaluation Metrics

[0130] The performance of GILGeo is evaluated by the following methods: Root Mean Square Error (RMSE), Mean Absolute Error (MAE) and Median Error (Median). In addition, 10 experiments were conducted with different seeds and the average value was taken to ensure the reliability of the experiment.

[0131] 3. Baseline Introduction

[0132] Geoping: Utilizes the correlation between geographic distance and network delay to estimate the location of IP by comparing the similarity of network delay. Its implementation process is referenced by [Padmanabhan VN, Subramanian L. An investigation of geographic mapping techniques for Internet hosts [C] / / Proceedings of the 2001 conference on Applications, technologies, architectures, and protocols for computer communications. 2001: 173-185.]

[0133] XLBoost-Geo: Extract location clues from web pages to establish landmarks, and then estimate the location of the target IP based on the nearest landmarks, eliminating the need for web mining during dataset creation. In the experiment, only the geolocation strategy was used, and its implementation process is referenced in the literature [wang Y, Zhu H, Wang J, et a1.Xlboost-geo: An ipgeolocation system based on extreme landmark boosting[J].arXiv preprintarXiv:2010.13396, 2020.]

[0134] MLP-Geo: First, a coarse area is determined using latency information, routing paths, and geographic coordinates (latitude and longitude), and then the location is refined to the street level using a multi-layer perceptron (MLP) neural network. The implementation process is referenced in [Zhang F, Liu F, Luo X. Geolocation of covert communication entity on the Internet for post-steg analysis [J]. EURASIP Journal on Image and Video Processing, 2020, 2020: 1-10.]

[0135] TabNet: Uses sequential attention for feature selection and attribute exploration. For fair comparison, the hyperparameters that achieve the best mean absolute error (MAE) on the evaluation dataset are used. The implementation process is referenced in the literature [Arik S Pfister T. Tabnet: Attentive interpretable tabular learning[C] / / Proceedings of the AAAI conference on artificial intelligence. 2021, 35(8): 6679-6687.】

[0136] GNN-Geo: Converts IP addresses and their connections into a graph structure, using a series of preprocessing, encoding, message passing, and decoding steps to accurately map IP locations. Its implementation process is referenced in [Ding S, Luo X, Wang J, et al. finn-geo: A graph neural network-based fine-grained ip geolocation framework [J]. IEEE Transactions on Network Science and Engineering, 2023, 10(6): 3543-3560.]

[0137] GraphGeo: Builds a graph using only target hosts and landmarks, and uses a continuous normalized stream to account for the uncertainty and noise caused by network congestion and jitter common in complex network environments. The implementation process is referenced by [Wang Z, Zhou F, Zeng W, et al. Connecting the hosts: Street-level ip geolocation with graph neural networks[C] / / Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining.2022:4121-4131.]

[0138] TrustGeo: Emphasizes the importance of trustworthiness in building a reliable geolocation system and combines evidence uncertainty learning to achieve uncertainty estimation. In addition, considering the dynamic characteristics of the constructed router-level graph, the NIG summation operation is introduced for adaptive information fusion. The implementation process is referenced in [Tai W, Chen B, Zhou F, et al. Trustgeo: Uncertainty-aware dynamic graph learning for trustworthy ipgeolocation[C] / / Proceedings of the 29th ACM SIGKDD Conference on KnowledgeDiscovery and Data Mining.2023:4862-4871.]

[0139] RIPGeo: Focusing on data quality, we integrate two adversarial training strategies into a multi-task learning framework to enhance model robustness and alleviate homogeneous representation. The implementation process is referenced by [Tai W, Chen B, Zhong T, eta1.Ripgeo: Robust street-level ip geolocation[C] / / 202324th IEEE International Conference on Mobile Data Management(MDM).IEEE, 2023: 138-147.]

[0140] HGL _ Geo: Use hyperedges to model a group of IP hosts with strong geographic location correlation, and merge IP knowledge and connection relationships into the hypergraph. The implementation process is referenced by [Ma Z, Hu X, Li N, et al.1.HGL _ GEO: Finer-grained IPv6 geolocation algorithm based on hypergraph learning[J]. Information Processing&Management, 2023, 60(6): 103518.】

[0141] ExGeo: Implemented a target-centric IP graph method to increase the density of the graph. In addition, the GIB strategy was used to improve the interpretability of adjacent nodes. The implementation process is referenced in [Yang K, Tai W, Li Z, et al. Exploring Self-Explainable Street-Level IP Geolocation with Graph Information Bottleneck[C] / / ICASSP 2024-2024IEEE International Conference on Acoustics, Speech and Signal Processing(ICASSP).IEEE, 2024: 7270-7274.]

[0142] Experimental Results

[0143] The geolocalization performance of GILGeo and baseline models is summarized in the chart, with bold and underlined values ​​representing the best and suboptimal metrics, respectively. The analysis shows that feature learning methods such as MLP-Geo and TabNet tend to perform poorly. These methods treat landmarks as isolated points and only focus on the correspondence between features and labels, while ignoring the topological relationship. As a result, this correspondence, which works well in in-distribution scenarios, fails in out-of-distribution environments, resulting in degraded performance. In contrast, rule-based methods such as GeoPing and XLBoost-Geo estimate the target location based on the nearest landmarks, maintain reasonable accuracy under challenging conditions, and perform well in out-of-distribution data. Experimental results show that simple and efficient rule-based methods outperform feature learning methods in out-of-distribution scenarios.

[0144] With the increasing popularity of graph neural networks, it has been observed that graph neural networks have achieved significant improvements in geolocation accuracy compared to traditional methods. This improvement stems from the ability of graph neural networks to simultaneously consider node features and inter-node topology. The results show that the MAE of rule-based methods on the three datasets are 6.89, 2.38, and 2.9 times that of graph-based methods, respectively, while the errors of feature learning methods are 17.98, 12.01, and 5.42 times that of graph-based methods, respectively. Overall, model GILGeo outperforms all other models in MAE and median metrics, and only lags behind TrustGeo in RMSE. This may be attributed to TrustGeo's superior handling of sparse graphs, resulting in fewer outliers and lower RMSE values. In addition, New York's geolocation performance significantly exceeds that of the other two cities, possibly due to its higher node density, while Shanghai exhibits the lowest performance.

[0145] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. The patent protection scope of the present invention shall be based on the claims. All equivalent structural changes made using the contents of the description and drawings of the present invention should also be included in the protection scope of the present invention.

Claims

1. A distributed generalized IP geolocation method based on invariant learning, characterized in that: The following steps are involved: Step 1: Represent the IP graph as G = (A, X), where A is the adjacency matrix, X = [X a , X m ] is the attribute data X a and measurement data X m combination of; Step 2: Assume there are m landmarks in the IP graph and n target nodes Update the target node information through the graph neural network to predict the target's longitude and latitude; Step 3: Aggregate the latitude and longitude information of the landmarks, obtain the normalized attention coefficient, and output the features of each target node: Where: l i Indicates the target IP address. Represents all landmarks in the IP graph, Yes i Neighbor, y j is the real latitude and longitude of the landmark; Step 4: Split the extractor Φ(·) into two parts: node feature extractor Φ x (·) and the topology extractor Φ a (·), for node features, use feature masks To extract the invariant features X inv : X inv =X⊙M x ,M x =Φ x (X), Among them: ⊙ represents the element-by-element product; For the graph topology, use the topology mask to filter out useless landmarks and obtain the unchanged graph topology A inv : A inv =A⊙M a ,M a =Φ a (A); Use reparameterization to replace M x and M a ; Step 5: For the graph topology, discard the noise nodes that are useless for prediction and reduce the prediction effect, and only use the landmarks that are helpful for predicting the target, that is, A inv As the adjacency matrix, for node features, through the node feature extractor Φ X (·) Get the invariant feature X inv and shortcut feature X s =XX inv , hybrid features are generated through environment-agnostic strategies, expressed as: Where: X′ s Yes X s The disrupted order, A mixed feature set that represents the sum of the invariant component of a node and the shortcut component of any other node; Step 6: Mix the feature set With the unchanged adjacency matrix A inv Input them into the model together to get the second loss function: Step 7: Regularize node features, topology structure, and parameters to maintain the desired properties of the IP graph, and update model parameters by optimizing the target to obtain an IP geolocation model with out-of-distribution generalization capability.

2. The distributed generalized IP geolocation method based on invariant learning according to claim 1 is characterized in that: The adjacency matrix defined in step 2 is: when i∈{0, 1, ..., m-1} and j∈{m, m+1, ..., n-1}, A ij =1, otherwise set to 0; The structure of the corrected adjacency matrix is ​​as follows:

3. The distributed generalization IP geolocation method based on invariant learning according to claim 1 is characterized in that: The re-parameterization method in step 4 is as follows: Among them: σ(·) is the Sigmoid function, ∈~Uniform(0,1) obeys uniform distribution, τ is the temperature, when the temperature coefficient is low, the sampling process can be approximated as Bernoulli sampling, and the edge sharp mask is obtained. When the temperature coefficient is high, it is interpreted as a probabilistic selection, which means that the model's selection of specific features is not absolute, but has a certain weight or uncertainty. After obtaining the invariant component and the shortcut component, the loss function is: For the above formula, we derive a tractable variational upper bound: Where: H(Y) is a constant, and P θ (Y|Φ(G e ))The θ in it is f θ θ in, rewrite the loss function as: in: is the number of target nodes in graph G, represents the prediction regression loss of the target-centered self-graph, and note that X and A represent the features and adjacency matrix of the target-centered self-graph.

4. The distributed generalization IP geolocation method based on invariant learning according to claim 1 is characterized in that: Before aggregating the latitude and longitude information of the landmarks in step 3, the shared linear transformation Applied to each node Calculate the attention coefficient:

5. The distributed generalization IP geolocation method based on invariant learning according to claim 1 is characterized in that: The node feature regularization method in step 7 is as follows: In the feature mask M x The l1 norm is added as a regularization term to impose a constraint on the size, which is defined as: R1=||M x ||1。 6. The distributed generalization IP geolocation method based on invariant learning according to claim 5 is characterized in that: The topological structure regularization method in step 7 is as follows: A random attention mechanism is used to extract high-quality IP graph structures. Another regularization term on topology is defined as: R2=KL(P(M a |X)||Q(M a )), Where: P(M a |X) is the posterior Bernoulli distribution of the edge, Q(M a ) is the prior Bernoulli distribution of the edge with parameter r, simplifying the KL divergence between the two Bernoulli distributions and rewriting R2 as: Where: E represents the set of edges, π uv Represents the probability that edge (u, v) is sampled.

7. The distributed generalization IP geolocation method based on invariant learning according to claim 6 is characterized in that: The parameter regularization method in step 7 is as follows: Introducing 12 regularization into the parameters reduces the risk of overfitting during training and makes the model more adaptable to unseen data, expressed as:

8. The distributed generalization IP geolocation method based on invariant learning according to claim 7 is characterized in that: The optimization objective in step 7 can be defined as: Among them: λ1, λ2 and λ3 are node characteristics, topological structures and parameter regularization coefficients respectively.

Images