Network equipment IP address geographic position protection method based on graph adjustment
By deploying candidate landmarks around the target IP and modifying the graph structure and attributes using graph adjustment methods, adversarial examples are generated. This solves the problem of the abuse of high-precision IP positioning technology, improves the adversarial effect, and protects the geographical location privacy of network devices.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-16
- Publication Date
- 2026-04-03
AI Technical Summary
Existing high-precision IP location technology is easily abused, leading to the leakage of network device geolocation privacy data, and existing countermeasures are not very effective against IP location methods based on graph neural networks.
By deploying candidate landmarks around the target IP and using a greedy strategy to modify the graph structure and attributes to a limited extent, adversarial examples are generated to improve the positioning error of the IP positioning method based on graph neural networks and protect geographic location privacy.
It effectively improves the positioning error of the IP positioning method based on graph neural networks, reduces interference with normal network communication, and achieves efficient and accurate geographical location protection for network devices.
Smart Images
Figure CN121792136A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and in particular to a method for protecting the geographical location of network device IP addresses based on graph adjustment. Background Technology
[0002] With the increasing application and attention given to IP location technology, more and more high-precision IP location technologies have been invented, and the accuracy of algorithmic location is on the rise. In particular, network-based IP location technology: theoretically, as long as a target IP can be measured by the network, its network-based IP location can be performed. This characteristic makes such algorithms non-cooperative and low-awareness. At the same time, due to its high location accuracy, this type of algorithm is widely used and has become one of the mainstream location methods in the IP location field. However, due to the imperfections in relevant laws and regulations, network protocols, industry standards, and countermeasures, high-performance IP location technologies are susceptible to abuse by network attackers. Currently, some of the most advanced IP location technologies can obtain fine-grained location information of target devices without their awareness, authorization, or cooperation, with location errors as low as hundreds of meters, posing a potential threat of leakage to the privacy of network device geographic location data.
[0003] To illustrate the dangers of the above situations more concretely, consider the following scenarios: 1. A competitor, seeking to harm a company, uses high-precision IP location technology to obtain the precise geographical location of the company's servers, subsequently engaging in activities such as Trojan horse implantation, data theft, and equipment damage, causing significant economic losses; 2. A merchant, seeking retaliation against a consumer who submits a negative review, obtains the precise geographical location of the consumer by locating their frequently used device, then tracks, threatens, or even harms them, jeopardizing the consumer's personal safety; 3. Cyber attackers collect and locate the IP addresses of devices belonging to businesses and individuals, determining the device's geographical location and generating targeted phishing messages, significantly increasing the probability of users clicking malicious links, thereby enabling telecommunications fraud and the spread of cyber viruses. It is evident that the abuse of high-precision IP location algorithms can lead to serious consequences. Therefore, researching countermeasures against the abuse of IP location to protect network devices from incorrect geographical location detection is of great importance to both businesses and individual users.
[0004] In recent years, deep neural network methods such as graph neural networks have gradually gained attention from IP location researchers. Graph deep neural network-based IP location methods significantly outperform classical IP location methods in average metrics such as maximum error and average error. If used by attackers, they pose a greater potential threat to the geographic location privacy of network devices. However, there are currently no specific IP geographic location protection technologies to counter these methods. Graph deep neural networks are more adaptable to complex network environments, and existing countermeasures against spoofed landmarks are relatively simple and weak. Therefore, this paper explores a graph-adjusted method for protecting the geographic location of network device IP addresses, specifically targeting IP location methods based on graph neural network models. Summary of the Invention
[0005] To overcome the shortcomings of existing technologies, this invention proposes a network device IP address geolocation protection method based on graph adjustment. By deploying candidate landmarks around the target IP to be protected, adversarial examples are generated by modifying the graph structure (edge deletion) and attributes (delay features) to a limited extent using a greedy strategy. This can effectively improve the positioning error of the current state-of-the-art IP positioning method based on graph neural networks, thereby protecting the geolocation privacy data of the specified IP.
[0006] To achieve the above objectives, the technical solution adopted is:
[0007] This invention provides a method for protecting the geographical location of network device IP addresses based on graph adjustment, comprising the following steps:
[0008] Input the original graph G based on network topology detection data of the target IP and its surrounding landmarks. (0) The IP localization method based on graph neural networks (GNN-Geo) consists of the following parameters: W; target IP node v0 whose geographical location needs to be protected from incorrect localization by GNN-Geo; and a set of candidate landmark nodes. and the upper limit of counter-resources μ;
[0009] Initialize the current graph G (t) =G (0) Set the number of modifications r = 0;
[0010] Repeat the following operations until r ≥ μ:
[0011] a) Generate a set C of edges that can be modified. edge That is, the edges that can be modified, where each edge in the edge set has at least one end connected to a candidate landmark node, and the set of features that can be modified, C. feat That is, the features that can be modified are the features of the candidate landmark nodes;
[0012] b) Calculate C edge Each edge in C featThe adversarial score for each feature;
[0013] c) Select the modification operation with the highest score. If it is an edge modification, update the adjacency matrix; if it is a feature modification, update the feature matrix.
[0014] d) Update the current graph G (t+1) The number of modifications, r′ = r + 1;
[0015] Output the modified graph G (Δ) This enables countermeasures against IP location methods based on graph neural networks.
[0016] According to the network device IP address geolocation protection method based on graph adjustment of the present invention, the candidate landmark node set is further... The number of nodes is 3 to 4, and they are controlled by the defender. The edge structure or feature attributes can be modified. The number of network hops between the nodes in the candidate landmark node set and the target IP node v0 does not exceed 2 hops, that is, the candidate landmark node and the target IP node v0 share a nearest router. If the target IP node v0 itself is controlled by the defender and has no low-latency communication requirements, then the target IP node v0 itself can also be included in the candidate landmark node set.
[0017] According to the network device IP address geolocation protection method based on graph adjustment of the present invention, the edge modification is an edge deletion operation, which is achieved by hiding the routing links near the candidate landmark node, and the feature modification is to modify the delay feature of the candidate landmark node, which is achieved by adjusting the delay data.
[0018] According to the network device IP address geolocation protection method based on graph adjustment of the present invention, the set of features C that can be modified is further defined as follows: feat The adversarial score for each feature is calculated using the following formula:
[0019]
[0020] Among them, c old Let represent the correct geographical location of the target IP node, c represent the geographical location predicted by the adversarial modified GNN-Geo model, and A represent the adjacency matrix. This represents the feature matrix after modifying a candidate feature, where W represents the parameters of the GNN-Geo model. This represents the confidence score of the model's prediction that the target IP node v0 is located in geographical location c. This indicates that the model predicts the target IP node v0 to be located in geographical location c. old The confidence score.
[0021] According to the network device IP address geolocation protection method based on graph adjustment of the present invention, in practice, the adversarial scoring adopts a simplified method based on the location error increment, specifically including:
[0022] In the original unmodified graph G (0) Train the GNN-Geo model and, after minimizing its localization error, fix the model parameters while obtaining the original localization error of the target IP node v0.
[0023] For the set of features that can be modified, C feat For each feature, perform the operation of modifying the delay features of the candidate landmark nodes to form a temporary modified map;
[0024] The trained GNN-Geo model is used to locate the temporary modified graph, and the new location error of the target IP node v0 is calculated.
[0025] The adversarial score corresponding to this feature is defined as the difference between the new positioning error and the original positioning error;
[0026] For the set of edges C that are allowed to be modified edge For each edge in the algorithm, its adversarial score is calculated in the same way as the feature modifications described above;
[0027] Finally, from all candidate edges and candidate features, the one with the highest adversarial score is selected as the specific modification operation to be performed in this round.
[0028] According to the network device IP address geolocation protection method based on graph adjustment of the present invention, the upper limit μ of the adversarial resource is further constrained in the following form:
[0029]
[0030] in, This represents the modified adjacency matrix. This represents the modified feature matrix, limiting the number of modifications to the original image nodes and attributes to a specified limit.
[0031] The beneficial effects achieved by adopting the above technical solution are:
[0032] 1. This invention deploys 3-4 candidate landmarks controlled by the defender within 2 hops around the target IP to be protected, focusing on "high-influence nodes" to carry out modification operations, avoiding indiscriminate adjustments to the entire network topology. This reduces interference with normal network communication and, through the combination of "adjacency matrix edge deletion (hiding routes near candidate landmarks) + feature matrix optimization (modifying the delay features of candidate landmarks)," accurately disrupts the dependence of graph neural network-based IP location methods on topology and attribute features.
[0033] 2. This invention employs a "greedy strategy + incremental calculation technique" to select the optimal modification operation—by calculating the adversarial score of edge and delay feature modifications, the operation with the strongest adversarial effect is selected first within the limited adversarial resource limit, achieving "low cost and high protection" and avoiding resource waste.
[0034] 3. Compared with traditional fake landmark methods, this invention designs adversarial logic based on the characteristics of graph neural networks. Experimental data shows that it can significantly improve the localization error of the GNN-Geo method, effectively solving the problem of the weakening adversarial effect of traditional methods against graph neural network-based IP localization algorithms. Ultimately, while ensuring the normal operation of the network, it achieves efficient and accurate protection of the geographical location of network devices, providing a more suitable solution for deep learning scenarios for IP localization privacy protection. Attached Figure Description
[0035] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings of the embodiments of the present invention will be briefly described below. The drawings are merely illustrative of some embodiments of the present invention and are not intended to limit the scope of the present invention to all embodiments.
[0036] Figure 1 This is a flowchart illustrating an existing IP location method based on graph neural networks;
[0037] Figure 2 This is a flowchart illustrating the network device IP address geolocation protection method based on graph adjustment according to an embodiment of the present invention. Detailed Implementation
[0038] The exemplary solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Unless otherwise defined, the technical or scientific terms used in this invention should have the ordinary meaning understood by one of ordinary skill in the art.
[0039] First, it's necessary to understand the IP location methods based on graph neural networks that this method targets: Graph neural network-based IP location methods have significantly better average errors than classical IP location methods, and therefore have gained attention in the IP location field in recent years. Here, we introduce the basic principle of a typical graph neural network-based IP location method, namely GNN-Geo. The GNN-Geo method mainly consists of four modules: a preprocessing layer, a feature encoding layer, a GNN-based network modeling layer, and a latitude and longitude location mapping layer, such as... Figure 1 As shown, the basic steps are as follows:
[0040] ① First, perform network topology path measurement on the IP address to be located, as well as other landmarks within the same city;
[0041] ② Input the network topology path data obtained in step 1 into the measurement data preprocessing layer. This layer will process the data and map the network topology into a graph G. In this graph, each IP address is a node of the graph, and each pair of IP routing links is an edge of the graph.
[0042] ③ Subsequently, other measured data such as latency, IP address, and domain name are converted into features of nodes and edges, i.e., attributes, by the feature encoding layer. In this way, the original network measurement data is transformed into an attribute graph.
[0043] ④ The network modeling layer based on GNN continues to process the attribute graphs generated in the first two steps. The GNN method is used to inject various graph structure signals and graph attribute signals that are potentially related to geographical location into the features of graph nodes (i.e., IP addresses).
[0044] ⑤ The latitude and longitude location mapping layer maps node features to geographical locations represented by latitude and longitude. During the training phase of deep learning, the difference between the estimated location of a node with a known geographical location and its true location can be calculated, and the weight parameters of each layer of the neural network can be continuously adjusted to minimize the difference.
[0045] ⑥ Stop adjusting once the difference between the estimated location and the actual location stops decreasing. After that, the trained method can be used to estimate the geographic location of target IP nodes in unknown geographic locations.
[0046] The IP location method based on graph neural networks described above was used to locate IP addresses in several cities in my country. Under the condition of no interference, the average location error is shown in Table 1. It can be seen that this method is indeed superior to the classic IP location method.
[0047] Table 1 shows the localization accuracy of GNN-Geo under non-adversarial conditions.
[0048]
[0049] The core idea of this invention is to cleverly adjust the structure and properties of the graph, causing GNN-Geo and similar graph neural network-based IP localization methods to output incorrect location predictions. The following section will use GNN-Geo as an example to introduce the basic principles of countering graph neural network-based IP localization methods.
[0050] (1) Formal expression of the GNN-Geo method
[0051] The output of GNN-Geo is the latitude and longitude location of each IP address. Each IP address is a node in the GNN-Geo input graph. Although latitude and longitude are two-dimensional, each dimension contains identical linear data. Therefore, GNN-Geo is essentially a graph node regression method. The objective of the GNN-Geo method can be formalized as follows:
[0052]
[0053] The right side of the equation:
[0054] ① A The adjacency matrix of the input graph G to GNN-Geo is essentially the computer network topology information of the city where the target IP is located;
[0055] ② X The input graph G to GNN-Geo is an attribute matrix representing the attribute information of computer network nodes and edges, such as latency, hop count, IP address itself, and domain name.
[0056] ③f θ It is the classifier, which is the entire computational model of GNN-Geo, including all neural networks and their parameters such as the embedding layer, GNN layer, and position mapping layer.
[0057] ④l(f θ (X,A) i ,y i () refers to the loss function, which can be calculated as f θ (C,A) i With y i The difference between two vectors;
[0058] ⑤f θ (X,A) i This refers to the input graph G = f in GNN-Geo. θ A node υ of (X,A) i After obtaining a certain IP address, the predicted latitude and longitude values of the node are calculated.
[0059] ⑥y i This refers to a node v i (i.e., the actual latitude and longitude values of a certain IP address);
[0060] ⑦ China V L This refers to all the IP addresses discovered by GNN-Geo in its initial measurements.
[0061] In summary, the right side of this formula represents the sum of the differences obtained by the GNN-Geo algorithm in predicting the address of each node (IP address) based on all the information of the input G, and comparing it with the actual geographical location. In simpler terms, it is the overall error value obtained by predicting after training GNN-Geo.
[0062] Now observe the left side of the equation:
[0063] The left side of the equation is the objective of the formula, which is to minimize the loss, or in other words, to solve for f. θ This makes the total error value on the right side of the formula (simplified here to be...) That is, minimizing the total error during the training phase. Of course, if GNN-Geo minimizes the overall prediction error during the training phase, then the predicted IP address geographic location will be highly close to the actual geographic location.
[0064] (2) Formal expression of the GNN-Geo method
[0065] The main purpose of countermeasures should be to make It cannot be minimized, or it is better to make it as large as possible. The formalization is as follows:
[0066]
[0067] Formula (2) consists of the main formula (above) and the conditional formula (below). The right side of the equal sign in the main formula is:
[0068] ① The given graph G = (X, A) is a computer network attribute graph of the city to which the target IP to be protected belongs.
[0069] ② Set of adversarial nodes (A collection of fake landmarks to be used to protect target IPs);
[0070] ③y u This represents the geographical location (actual geographical location) of node u;
[0071] ④ The purpose of this invention is to construct a disturbed image. It can maximize the sum of the attack loss function. In other words, the graph constructed after interference, when input into GNN-Geo, can maximize the error of IP location.
[0072] ⑤ The so-called l atk It is the attack loss function, l atk =l (l comes from Formula 1, i.e., the geographic location difference loss function, which is used to measure the difference between the predicted geographic location and the actual geographic location);
[0073] ⑥ The meaning of the conditional formula is to indicate θ * It is a set of parameters trained and optimized by the locator using the GNN-Geo algorithm. The locator will use this set of parameters to drive the GNN-Geo algorithm for IP geolocation estimation.
[0074] Theoretically, if G = (X, A) could be significantly altered—for example, by deleting all nodes in x or all edges in A—it would cause a large difference between the predicted and actual geographical locations of nodes. This deletion process essentially changes the network structure of the city where the IP address resides. However, in reality, most defenders find it difficult to alter the network structure of an entire city. Even top-tier telecom operators like China Telecom would almost never adjust the network structure of an entire city to protect the geographical location of a single IP address, as this would disrupt normal network communication. Therefore, the key problem this invention addresses is how to modify graph G within a limited budget to achieve a balance between offensive effectiveness and cost.
[0075] Generally, setting up a few special landmarks to protect a small number of critical targets, or performing minimal route anonymization around the IP nodes to be protected, is a reasonably costly approach. This translates to a requirement at the method design level that the cost budget for graph adversarial attacks cannot be excessively high. This constraint can be formalized into a formula. in, This represents the modified adjacency matrix. This represents the modified feature matrix, where μ is the upper limit of adversarial resources. This formula means that modifications to nodes and attributes in the original graph cannot exceed the specified maximum number of modifications.
[0076] Based on the above fundamental principles, this invention discloses a method for protecting the geographical location of network device IP addresses based on graph adjustment, such as... Figure 2 As shown, it includes the following steps:
[0077] Step S101: Input the original graph G based on the network topology detection data of the target IP and its surrounding landmarks. (0) The model parameters W of GNN-Geo; the target IP node v0 whose geographical location needs to be protected from being correctly located by GNN-Geo; and the set of candidate landmark nodes whose location needs to be modified (attributes or structure modified) to protect v0's location. And the upper limit of the adversarial resources μ, which is an integer greater than 1 and is generally determined by the defender. Generally speaking, the smaller the budget, the fewer computer network topologies and features need to be modified by this method, but the weaker the protection effect on v0.
[0078] Candidate landmarks refer to other network devices near v0 that can be controlled by the defender to alter their networking behavior and measurement characteristics.
[0079] Step S102: Initialize the current graph G (t) =G (0) Set the number of modifications r = 0 (r refers to the r-th modification).
[0080] Step S103: Repeat the following operations until r ≥ μ:
[0081] a) Generate a candidate modification set, including the set C of edges that are allowed to be modified. edge (Each modified edge must connect to a candidate landmark node at least once, and the modification must satisfy the degree distribution constraint) and the set of features C that can be modified. feat (The features that can be modified are all features of the candidate landmark nodes, and the modified features must satisfy the feature co-occurrence constraint).
[0082] b) Calculate the score: For C edge For each edge e in the equation, calculate the adversarial score s. edge (e) = M(A′,X;W,v0), where A′ is the adjacency matrix after modifying this edge; for C feat For each feature f in the dataset, calculate the adversarial score s. feat (f) = M(A,X′;W,v0), where X′ is the feature matrix after modifying this feature.
[0083] c) From all candidate edges and candidate features, select the modification operation with the highest score; if the highest score is for an edge modification, update the adjacency matrix A. (t+1) =A (t) ±e; if the highest score is a feature modification, then execute X. (t+1) =X (t) ±f;
[0084] d) Update the current graph G (t+1) The number of modifications, r′ = r + 1.
[0085] Step S104: Output the modified graph G (Δ) This enables countermeasures against IP location methods based on graph neural networks.
[0086] As can be seen from the steps above, this method is essentially a greedy algorithm, which modifies the edges or features of candidate landmarks from the candidate modifications each time to ultimately provide an adversarial strategy.
[0087] It should be clarified that the defender's modification of candidate landmark edges generally involves edge deletion, achieved by hiding the routing links near the candidate landmark node. This is typically done through anonymous routers (set to drop and not respond to probe packets), thus concealing the actual routing path between the candidate landmark and the rest of the network. Furthermore, assuming some defenders can mobilize significant network infrastructure resources and require more effective relocation of critical defense nodes within the city, this method can also employ edge addition. This requires laying a high-speed, near-straight-line fiber optic cable between the candidate landmark and a distant network router within the city. Compared to edge deletion based on anonymity, this operation can more effectively deviate the target IP's location, shifting it closer to the aforementioned distant network router. Modification of features involves altering the latency characteristics of the candidate landmark node, achieved by adjusting latency data. These operations are all implemented by the defender through control of the network devices corresponding to the candidate landmark.
[0088] Candidate landmarks are landmark nodes initially deployed in the network that can be modified. Similar to fake landmarks, candidate landmarks are also IP nodes controlled by the defender and can be modified to protect the target IP. Unlike fake landmarks, this solution does not directly modify the geographical location of candidate landmarks, but requires that the candidate landmarks be close to the target IP node to be protected, with a network hop count of less than 2 hops, meaning that the candidate landmark node and the target IP node v0 share the nearest router. Generally, 3 to 4 candidate landmarks need to be deployed around the target IP node to be protected, with a network hop count of 1 to 2 hops. If the target IP node v0 is a network device controlled by the defender, and the defender does not have strict low-latency communication requirements for the target IP node v0, then the target IP node v0 can also be included in the candidate landmark node set. However, in general, the defense measures need to minimize the impact on the communication performance of the target IP node v0, so the latency of the target IP node v0 itself is generally not modified. Therefore, even if the target IP node v0 is included in the candidate landmark node set, edge deletion can only be performed through anonymous routing.
[0089] A generalized set of features that can be modified, C feat The adversarial score for each feature can be calculated using the following formula:
[0090]
[0091] Among them, c odd Let represent the correct geographical location of the target IP node to be protected (i.e., the location correctly predicted by the model before the attack), c represent the geographical location predicted by the GNN-Geo model after adversarial modification, and A represent the adjacency matrix. This represents the feature matrix after modifying a candidate feature, where W represents the parameters of the GNN-Geo model. This represents the confidence score of the model's prediction that the target IP node v0 to be protected is located in geographical location c. This indicates that the model predicts the target IP node v0 to be protected is located in geographical location c. 0ld The confidence score; max means iterating through all possible error locations c and finding the c that maximizes the above difference. This maximum difference is the final score after the current modification. Then, the set of edges C that can be modified. edge The adversarial score formula for each edge is similar to formula (3) above, except that A in that formula is replaced with... Replace with X, where, Let X represent the adjacency matrix after modifying this candidate edge, and let X represent the feature matrix.
[0092] However, calculating the theoretical optimal solution of the above formula is very difficult. In practice, defenders can use the following simplified method based on the localization error increment to select the best edge and feature:
[0093] In the original unmodified graph G (0) Train the GNN-Geo model and, after minimizing its localization error, fix the model parameters while obtaining the original localization error of the target IP node v0.
[0094] For the set of features that can be modified, C feat For each feature, perform the operation of modifying the delay features of the candidate landmark nodes to form a temporary modified map; use the trained GNN-Geo model to locate the temporary modified map and calculate the new location error of the target IP node v0;
[0095] The adversarial score corresponding to this feature is defined as the difference between the new positioning error and the original positioning error;
[0096] For the set of edges C that are allowed to be modified edge For each edge in the algorithm, its adversarial score is calculated in the same way as the feature modifications described above;
[0097] Finally, from all candidate edges and candidate features, the one with the highest adversarial score is selected as the specific modification operation to be performed in this round.
[0098] To verify the effectiveness of this scheme, further explanations and illustrations are provided below based on experimental data.
[0099] To preliminarily test the anti-location effect of this method in a real network environment, some IP addresses in Beijing, Shanghai, Nanjing and Guangzhou, China were selected as protection targets. Four candidate landmarks were deployed around each target IP (within 2 hops). Then, a probe source was used to perform multiple network measurements on the target IP and all landmarks to obtain probe data. The IP high-precision positioning algorithm GNN-Geo based on graph neural network was used to locate the protected targets, and the changes in positioning error before and after anti-location were compared.
[0100] Table 2 shows the localization accuracy of GNN-Geo after using the adversarial method of this invention.
[0101]
[0102] The error variation is shown in Table 2, which illustrates that: (1) this method can effectively counter the GNN-Geo method and improve its positioning error; (2) when using candidate landmark adversarial resources, the graph adversarial attack method specifically designed for GNN-Geo can more effectively improve its positioning error. Therefore, it is necessary to develop targeted adversarial techniques for the rapidly developing IP positioning technology based on graph neural networks to improve the efficiency of location protection.
[0103] Finally, it should be noted that the above-described embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.
Claims
1. A method for protecting the geographical location of network device IP addresses based on graph adjustment, characterized in that, Includes the following steps: Input the original graph G based on network topology detection data of the target IP and its surrounding landmarks. (0) The IP localization method based on graph neural networks (GNN-Geo) consists of the following parameters: W; target IP node v0 whose geographical location needs to be protected from incorrect localization by GNN-Geo; and a set of candidate landmark nodes. and the upper limit of counter-resources μ; Initialize the current graph G (t) =G (0) Set the number of modifications r = 0; Repeat the following operations until r ≥ μ: a) Generate a set C of edges that can be modified. edge That is, the edges that can be modified, where each edge in the edge set has at least one end connected to a candidate landmark node, and the set of features that can be modified, C. feat That is, the features that can be modified are the features of the candidate landmark nodes; b) Calculate C edge Each edge in C feat The adversarial score for each feature; c) Select the modification operation with the highest score. If it is an edge modification, update the adjacency matrix; if it is a feature modification, update the feature matrix. d) Update the current graph G (t+1) The number of modifications, r′ = r + 1; Output the modified graph G (Δ) This enables countermeasures against IP location methods based on graph neural networks.
2. The network device IP address geolocation protection method based on graph adjustment according to claim 1, characterized in that, The set of candidate landmark nodes The number of nodes is 3 to 4, and they are controlled by the defender. The edge structure or feature attributes can be modified. The number of network hops between the nodes in the candidate landmark node set and the target IP node v0 does not exceed 2 hops, that is, the candidate landmark node and the target IP node v0 share a nearest router. If the target IP node v0 itself is controlled by the defender and has no low-latency communication requirements, then the target IP node v0 itself can also be included in the candidate landmark node set.
3. The network device IP address geolocation protection method based on graph adjustment according to claim 1, characterized in that, The edge modification is an edge deletion operation, which is achieved by hiding the routing links near the candidate landmark node. The feature modification is to modify the delay feature of the candidate landmark node, which is achieved by adjusting the delay data.
4. The network device IP address geolocation protection method based on graph adjustment according to claim 1, characterized in that, The set of features that can be modified, C feat The adversarial score for each feature is calculated using the following formula: Among them, c old Let represent the correct geographical location of the target IP node, c represent the geographical location predicted by the adversarial modified GNN-Geo model, and A represent the adjacency matrix. This represents the feature matrix after modifying a candidate feature, where W represents the parameters of the GNN-Geo model. This represents the confidence score of the model's prediction that the target IP node v0 is located in geographical location c. This indicates that the model predicts the target IP node v0 to be located in geographical location c. old The confidence score.
5. The network device IP address geolocation protection method based on graph adjustment according to claim 4, characterized in that, In practice, adversarial scoring is performed using a simplified method based on the incremental positioning error, specifically including: In the original, unmodified graph G (0) Train the GNN-Geo model and, after minimizing its localization error, fix the model parameters while obtaining the original localization error of the target IP node v0. For the set of features that can be modified, C feat For each feature, perform the operation of modifying the delay features of the candidate landmark nodes to form a temporary modified map; The trained GNN-Geo model is used to locate the temporary modified graph, and the new location error of the target IP node v0 is calculated. The adversarial score corresponding to this feature is defined as the difference between the new positioning error and the original positioning error; For the set of edges C that are allowed to be modified edge For each edge in the algorithm, its adversarial score is calculated in the same way as the feature modifications described above; Finally, from all candidate edges and candidate features, the one with the highest adversarial score is selected as the specific modification operation to be performed in this round.
6. The network device IP address geolocation protection method based on graph adjustment according to claim 1, characterized in that, The upper limit of the adversarial resources μ is constrained by the following form: in, This represents the modified adjacency matrix. This represents the modified feature matrix, limiting the number of modifications to the original image nodes and attributes to a specified limit.
7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 6.
8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1 to 6.