IP2vec: an IP node representation model for IP geolocation

doi:10.1007/s11704-023-2616-9

Frontiers of Computer Science

2024, Vol. 18

Issue (6): 186506 https://doi.org/10.1007/s11704-023-2616-9

本期目录

IP2vec: an IP node representation model for IP geolocation

Fan ZHANG^1,², Meijuan YIN^1,²(

), Fenlin LIU^1,², Xiangyang LUO^1,², Shuodi ZU^1,²

¹. State Key Laboratory of Mathematical Engineering and Advanced Computing, Zhengzhou 450001, China
². Key Laboratory of Cyberspace Situation Awareness of Henan Province, Zhengzhou 450001, China

全文: PDF(17087 KB) HTML

Abstract：

IP geolocation is essential for the territorial analysis of sensitive network entities, location-based services (LBS) and network fraud detection. It has important theoretical significance and application value. Measurement-based IP geolocation is a hot research topic. However, the existing IP geolocation algorithms cannot effectively utilize the distance characteristics of the delay, and the nodes’ connection relation, resulting in high geolocation error. It is challenging to obtain the mapping between delay, nodes’ connection relation, and geographical location. Based on the idea of network representation learning, we propose a representation learning model for IP nodes (IP2vec for short) and apply it to street-level IP geolocation. IP2vec model vectorizes nodes according to the connection relation and delay between nodes so that the IP vectors can reflect the distance and topological proximity between IP nodes. The steps of the street-level IP geolocation algorithm based on IP2vec model are as follows: Firstly, we measure landmarks and target IP to obtain delay and path information to construct the network topology. Secondly, we use the IP2vec model to obtain the IP vectors from the network topology. Thirdly, we train a neural network to fit the mapping relation between vectors and locations of landmarks. Finally, the vector of target IP is fed into the neural network to obtain the geographical location of target IP. The algorithm can accurately infer geographical locations of target IPs based on delay and topological proximity embedded in the IP vectors. The cross-validation experimental results on 10023 target IPs in New York, Beijing, Hong Kong, and Zhengzhou demonstrate that the proposed algorithm can achieve street-level geolocation. Compared with the existing algorithms such as Hop-Hot, IP-geolocater and SLG, the mean geolocation error of the proposed algorithm is reduced by 33%, 39%, and 51%, respectively.

Key words： IP geolocation network measurement node embedding

收稿日期: 2022-10-06 出版日期: 2023-10-20

Corresponding Author(s): Meijuan YIN

引用本文:

. [J]. Frontiers of Computer Science, 2024, 18(6): 186506.
Fan ZHANG, Meijuan YIN, Fenlin LIU, Xiangyang LUO, Shuodi ZU. IP2vec: an IP node representation model for IP geolocation. Front. Comput. Sci., 2024, 18(6): 186506.

链接本文:

https://academic.hep.com.cn/fcs/CN/10.1007/s11704-023-2616-9
https://academic.hep.com.cn/fcs/CN/Y2024/V18/I6/186506

Fig.1

Fig.2

Notations	Descriptions
$G$	Network topology, including nodes and edges
$V$	Nodes in $G$ (including vantage points, landmarks, target and routers)
$E$	The edge between nodes in $G$
$D u, v$	Minimum delay between $u$ and $v$
$Φ (u)$	The representation vector of node $u$
$R$	The Number of nodes in the topology
$M$	The Number of walks per node
$A$	A set of node walking sequences
$B u$	The number of nodes connected to node $u$
$π u, v$	The transition probability between nodes $u$ and $v$
$H t, x$	The minimum number of hops from node $t$ to node $x$
$W$	During a walk, the node set generated in the current sequence

Tab.1

Fig.3

Fig.4

Fig.5

Nodes	$x 1$	$x 2$	$x 3$	$x 4$	$x 5$	$x 6$	$x 7$	$x 8$	$x 9$	$x 10$	$x 0$
$x 1$	0	100	100	120	140	130	110	110	130	150	40
$x 2$	100	0	200	220	240	30	10	10	230	250	140
$x 3$	100	200	0	20	40	230	210	210	30	50	140
$x 4$	120	220	20	0	20	250	230	230	10	30	160
$x 5$	140	240	40	20	0	270	250	250	30	10	180
$x 6$	130	30	230	250	270	0	40	40	260	280	170
$x 7$	110	10	210	230	250	40	0	20	240	260	150
$x 8$	110	10	210	230	250	40	20	0	240	260	150
$x 9$	130	230	30	10	30	260	240	240	0	40	170
$x 10$	150	250	50	30	10	280	260	260	40	0	190
$x 0$	40	140	140	160	180	170	150	150	170	190	0

Tab.2

Node sequences
$A 1$ :	$x 7$	$x 2$	$x 7$	$x 2$	$x 6$	$x 2$	$x 6$	$x 2$	$x 1$	$x 3$
$A 2$ :	$x 8$	$x 2$	$x 1$	$x 5$	$x 10$	$x 5$	$x 1$	$x 3$	$x 1$	$x 0$
$A 3$ :	$x 6$	$x 2$	$x 8$	$x 2$	$x 1$	$x 0$	$x 1$	$x 3$	$x 1$	$x 6$
$A 4$ :	$x 8$	$x 2$	$x 6$	$x 2$	$x 8$	$x 2$	$x 7$	$x 2$	$x 6$	$x 2$

Tab.3

Node	IP vector
$x 6$	0.766	3.280	?4.614	?0.568	?2.233
$x 7$	?0.832	3.916	?2.837	1.185	?0.511
$x 8$	?1.431	3.032	?2.391	0.787	?1.438
$x 9$	?0.263	?1.165	0.338	?0.266	2.578
$x 10$	?0.085	?2.494	1.931	?0.385	5.829

Tab.4

IP vector	$Φ (x 6)$	$Φ (x 7)$	$Φ (x 8)$	$Φ (x 9)$	$Φ (x 10)$
$Φ (x 6)$	1	0.8245	0.8294	?0.6322	?0.7324
$Φ (x 7)$	0.8245	1	0.9568	?0.4757	?0.5525
$Φ (x 8)$	0.8294	0.9568	1	?0.6187	?0.7048
$Φ (x 9)$	?0.6322	?0.4757	?0.6187	1	0.9807
$Φ (x 10)$	?0.7324	?0.5525	?0.7048	0.9807	1

Tab.5

Fig.6

Node	IP vector
$x 3$	3.665	?1.332	2.385	?2.208	0.048
$x 4$	2.357	?0.325	1.872	?2.581	0.296
$x 6$	?3.072	3.115	?0.369	?1.987	3.201
$x 7$	?5.688	0.914	?0.490	0.648	4.091

Tab.6

IP vector	$Φ (x 3)$	$Φ (x 4)$	$Φ (x 6)$	$Φ (x 7)$
$Φ (x 3)$	1	0.9505	?0.4000	?0.6777
$Φ (x 4)$	0.9505	1	?0.1243	?0.5316
$Φ (x 6)$	?0.4000	?0.1243	1	0.7852
$Φ (x 7)$	?0.6777	-0.5316	0.7852	1

Tab.7

Fig.7

Node representation model	Node2vec [20]	IP2vec (Only use $C$ )	IP2vec ( $C$ with delay constraint)
Number of clusters	230	227	183
Mean distance/km	17.18	13.90	10.72

Tab.8

Fig.8

Notations	Descriptions
$I P g$	IP address of landmark node $g$
$L o c (I P g)$	Location of landmark $g$
$l n g g$ , $l a t g$	Latitude and longitude of landmark node $g$
$I P T$	IP address of target node $T$
$d a, p, q$	In the $a$ -th measurement, the delay from vantage point $p$ to node $q$
$χ (q, e)$	The number of hops between node $q$ and node $e$

Tab.9

Fig.9

Fig.10

Fig.11

Fig.12

Tab.10

$ω$	Geolocation median error/km
$ω$	Beijing	Zhengzhou	Hong Kong	New York
0	9.33	2.82	8.78	8.19
0.1	6.54	2.52	3.82	7.49
0.2	6.43	2.46	3.49	6.74
0.3	6.46	2.44	5.13	6.55
0.4	6.89	3.06	4.45	7.05
0.5	6.63	3.20	5.56	8.24
0.6	7.74	4.84	5.96	8.52
0.7	8.57	5.44	9.01	8.63
0.8	10.14	5.28	8.69	8.30
0.9	11.86	7.30	9.07	8.81
1.0	13.01	7.99	9.20	9.23

Tab.11

Fig.13

$ω$	Mean geolocation error/km
$ω$	Beijing	Zhengzhou	Hong Kong	New York
0	10.79	3.39	9.32	9.35
0.1	8.09	3.05	5.77	8.46
0.2	7.68	3.16	5.25	8.65
0.3	8.17	3.10	6.49	7.50
0.4	8.16	3.81	5.95	8.38
0.5	8.09	3.87	6.52	9.69
0.6	9.37	5.26	7.47	9.65
0.7	9.95	5.89	10.14	10.38
0.8	10.79	5.74	9.29	9.88
0.9	12.39	7.70	10.38	10.87
1.0	13.89	8.20	10.69	10.64

Tab.12

Fig.14

Tab.13

Tab.14

Fig.15

Fig.16

Tab.15

1	J A, Muir Oorschot P C Van . Internet geolocation: evasion and counterevasion. ACM Computing Surveys, 2009, 42( 1): 4
2	Dan O, Parikh V, Davison B D. Improving IP geolocation using query logs. In: Proceedings of the 9th ACM International Conference on Web Search and Data Mining. 2016, 347–356
3	Y, Wang D, Burgener M, Flores A, Kuzmanovic C Huang . Towards street-level client-independent IP geolocation. In: Proceedings of the 8th USENIX Conference on Networked Systems Design and Implementation. 2011, 365–379
4	F, Zhao R, Xu R, Li M, Zhu X Luo . Street-level geolocation based on router multilevel partitioning. IEEE Access, 2019, 7: 59237–59248
5	B, Gueye A, Ziviani M, Crovella S Fdida . Constraint-based geolocation of internet hosts. IEEE/ACM Transactions on Networking, 2006, 14( 6): 1219–1232
6	B, Wong I, Stoyanov E G Sirer . Octant: a comprehensive framework for the geolocalization of internet hosts. In: Proceedings of the 4th USENIX Conference on Networked Systems Design & Implementation. 2007, 23
7	Arif M J, Karunasekera S, Kulkarni S. GeoWeight: internet host geolocation based on a probability model for latency measurements. In: Proceedings of the 33rd Australasian Conferenc on Computer Science - Volume 102. 2010, 89–98
8	Z, Dong R D W, Perera R, Chandramouli K P Subbalakshmi . Network measurement based modeling and optimization for IP geolocation. Computer Networks, 2012, 56( 1): 85–98
9	G, Ciavarrini M S, Greco A Vecchio . Geolocation of internet hosts: accuracy limits through Cramér–Rao lower bound. Computer Networks, 2018, 135: 70–80
10	Q, Li Z, Wang D, Tan J, Song H, Wang L, Sun J Liu . GeoCAM: an IP-based geolocation service through fine-grained and stable webcam landmarks. IEEE/ACM Transactions on Networking, 2021, 29( 4): 1798–1812
11	O, Dan V, Parikh B D Davison . IP geolocation through reverse DNS. ACM Transactions on Internet Technology, 2022, 22( 1): 17
12	O, Dan V, Parikh B D Davison . IP geolocation through geographic clicks. ACM Transactions on Spatial Algorithms and Systems, 2022, 8( 1): 2
13	S, Zu X, Luo S, Liu Y, Liu F Liu . City-level IP geolocation algorithm based on PoP network topology. IEEE Access, 2018, 6: 64867–64875
14	F, Zhao X, Luo Y, Gan S, Zu Q, Cheng F Liu . IP geolocation based on identification routers and local delay distribution similarity. Concurrency and Computation: Practice and Experience, 2019, 31( 22): e4722
15	J N, Chen F L, Liu Y F, Shi X Luo . Towards IP location estimation using the nearest common router. Journal of Internet Technology, 2018, 19( 7): 2097–2110
16	S, Ding F, Zhao X Luo . A street-level IP geolocation method based on delay-distance correlation and multilayered common routers. Security and Communication Networks, 2021, 2021: 6658642
17	S, Zu X, Luo F Zhang . IP-geolocater: a more reliable IP geolocation algorithm based on router error training. Frontiers of Computer Science, 2022, 16( 1): 161504
18	H, Jiang Y, Liu J N Matthews . IP geolocation estimation using neural networks with stable landmarks. In: Proceedings of 2016 IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS). 2016, 170–175
19	F, Zhang F, Liu X Luo . Geolocation of covert communication entity on the internet for post-steganalysis. EURASIP Journal on Image and Video Processing, 2020, 2020( 1): 15
20	A, Grover J Leskovec . node2vec: scalable feature learning for networks. In: Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. 2016, 855–864
21	T, Mikolov K, Chen G, Corrado J Dean . Efficient estimation of word representations in vector space. In: Proceedings of the 1st International Conference on Learning Representations. 2013
22	F, Niu B, Recht C, Re S J Wright . HOGWILD!: a lock-free approach to parallelizing stochastic gradient descent. In: Proceedings of the 24th International Conference on Neural Information Processing Systems. 2011, 693–701
23	E, Schubert J, Sander M, Ester H P, Kriegel X Xu . DBSCAN revisited, revisited: why and how you should (still) use DBSCAN. ACM Transactions on Database Systems, 2017, 42( 3): 19
24	R P Lippmann . Pattern classification using neural networks. IEEE Communications Magazine, 1989, 27( 11): 47–50
25	Z, Tao Y Liu . A regional network topology construction algorithm based on sampling measurement. Journal of Physics: Conference Series, 2021, 1861( 1): 012025
26	B, Augustin X, Cuvellier B, Orgogozo F, Viger T, Friedman M, Latapy C, Magnien R Teixeira . Avoiding traceroute anomalies with Paris traceroute. In: Proceedings of the 6th ACM SIGCOMM Conference on Internet Measurement. 2006, 153–158
27	X, Liu W, Yang M, Yin F, Liu C Yun . Street-level landmark mining algorithm based on radar search. Journal of Internet Technology, 2021, 22( 2): 283–295
28	R, Li Y, Liu Y, Qiao T, Ma B, Wang X Luo . Street-level landmarks acquisition based on SVM classifiers. Computers, Materials & Continua, 2019, 59( 2): 591–606
29	T, Ma F, Liu X, Luo M, Yin R Li . An algorithm of street-level landmark obtaining based on yellow pages. Journal of Internet Technology, 2019, 20( 5): 1415–1428
30	N, Spring R, Mahajan D Wetherall . Measuring ISP topologies with rocketfuel. ACM SIGCOMM Computer Communication Review, 2002, 32( 4): 133–145
31	R, Govindan H Tangmunarunkit . Heuristics for internet map discovery. In: Proceedings of IEEE INFOCOM 2000. Conference on Computer Communications. Nineteenth Annual Joint Conference of the IEEE Computer and Communications Societies. 2000, 1371–1380
32	M H, Gunes K Sarac . Resolving anonymous routers in internet topology measurement studies. In: Proceedings of IEEE INFOCOM 2008 - The 27th Conference on Computer Communications. 2008, 1076–1084
33	T, Mikolov I, Sutskever K, Chen G, Corrado J Dean . Distributed representations of words and phrases and their compositionality. In: Proceedings of the 26th International Conference on Neural Information Processing Systems. 2013, 3111–3119

[1]

FCS-22616-OF-FZ_suppl_1

Download

Viewed

Full text

Abstract

Cited

Shared

Discussed