Leveraging Buffering Delay Estimation for Geolocation of Internet Hosts

A whole new class of location-aware services may be envisaged by the deployment of a geographic location service for Internet hosts. We focus on a technique that relies on delay measurements and the exploitation of a possible correlation between geographic distance and network delay. Our investigation shows that such a correlation becomes stronger as connectivity becomes richer. Host locations are inferred by comparing delay patterns of geographically distributed landmarks (hosts with a known geographic location) with the delay pattern of the target host to be located. The problem we deal with is how to best measure the similarity between the delay patterns of the landmarks and the one observed for the target host. The location estimation of the target host is the location of the landmark that presents the most similar delay pattern with respect to the one of the target host. We define and evaluate three similarity models. Experiments show that the previously adopted Euclidean distance is outperformed by other similarity models, resulting in a more accurate Internet host location from delay measurements.

In this paper, we ask whether it is possible to build an IP address to geographic location mapping service for Internet hosts. Such a service would enable a large and interesting class of location-aware applications. This is a challenging problem because an IP address does not inherently contain an indication of location.We present and evaluate three distinct techniques, collectively referred to as IP2Geo, for determining the geographic location of Internet hosts. The first technique, Geo Track, infers location based on the DNS names of the target host or other nearby network nodes. The second technique, GeoPing, uses network delay measurements from geographically distributed locations to deduce the coordinates of the target host. The third technique, GeoCluster, combines partial (and possibly inaccurate) host-to-location mapping information and BGP prefix information to infer the location of the target host. Using extensive and varied data sets, we evaluate the performance of these techniques and identify fundamental challenges in deducing geographic location from the IP address of an Internet host.

In this paper, we consider the problem of how to represent the locations of Internet hosts in a Cartesian coordinate system to facilitate estimation of network distances among arbitrary Internet hosts. We envision an infrastructure that consists of beacon nodes and provides the service of estimating network distance between pairs of hosts without direct delay measurement. We show that the principal component analysis (PCA) technique can effectively extract topological information from delay measurements between beacon hosts. Based on PCA, we devise a transformation method that projects the raw distance space into a new coordinate system of (much) smaller dimensions. The transformation retains as much topological information as possible and yet enables end hosts to determine their coordinates in the coordinate system. The resulting new coordinate system is termed as the Internet Coordinate System (ICS). As compared to existing work (e.g., IDMaps and GNP), ICS incurs smaller computation overhead in calculating the coordinates of hosts and smaller measurement overhead (required for end hosts to measure their distances to beacon hosts). Finally, we show via experiments with both real-life and synthetic data sets that ICS makes robust and accurate estimates of network distances, incurs little computational overhead, and its performance is not susceptible to the number of beacon nodes (as long as it exceeds a certain threshold) and the network topology.

We propose VoteGeo, an IoT-based voting approach, to verify the geographic location of the cloud hosts in moderately connected networks, where the correlation between the network delay and the distance is weak. We motive our work by showing that: 1) existing solutions, based on end-to-end delay measurement from a group of landmarks with known locations, are only workable when the relationship between the delay and the distance is strong, and 2) such landmark-based schemes are limited by landmark distribution and deployment costs. In our scheme, to enhance the verification accuracy, we develop a vote-based closest-shortest approach to determine the location of the target cloud host, which utilizes the adjacent landmarks with the shortest delays. In order to reduce deployment costs, we adopt random IoT devices (i.e., IP cameras) as landmarks, which are widely distributed and considerable. To reduce the measurement cost, we design a two-level probing method to determine the geographic location of the target cloud hosts step by step, eventually to the city-level. We introduce a delay threshold method, which does not rely on the IP address of the target cloud hosts, to defend against the middlebox-bypass attacks and the delay attacks (i.e., delay-shortening attacks and delay-adding attacks). The evaluation results show that VoteGeo outperforms existing schemes such as GeoGet [1] and CBG [2].

Network measurement based modeling and optimization for IP geolocation

Receiver playback buffers are required to smooth network delay variations. A playback buffer operates by introducing additional delay, acting as a holding area for packets whose scheduled playback time is in the future. Packets which arrive after their scheduled playback time are considered late and are discarded. The algorithms commonly used in the Internet are reactive, in that they measure immediate network delay variations and then adjust the buffer size to avoid lateness, resulting in potentially large end to end delays and frequent buffer changes. The paper works with an alternative predictive approach, which records historical information and uses it to make short term predictions about network delay, with the aim of not reacting too quickly to short lived variations. This allows an application controlled trade-off of packet lateness against buffering delay, suitable for applications which demand low delay but can tolerate or conceal a small amount of late packets. The paper builds on previous work by proposing aging techniques to improve delay predictions, evaluating performance using trace driven simulation.

This paper uses two commercial datasets of IP addresses from smartphones, geolocated through the Global Positioning System (GPS), to characterize the geography of IP addresses from mobile and broadband ISPs. Datasets that geolocate IP addresses based on GPS offer superlative accuracy and precision for IP geolocation and thus provide an unprecedented opportunity to understand both the accuracy of existing geolocation databases as well as other properties of IP addresses, such as mobility and churn. We focus our analysis on three large cities in the United States.After evaluating the accuracy of existing geolocation databases, we analyze the circumstances under which IP geolocation databases may be more or less accurate. Within our sample, we find that geolocation databases are more accurate on fixed-line than mobile networks, that IP addresses on university networks can be more accurately located than those from consumer or business networks, and that often the paid versions of these databases are not significantly more accurate than the free versions. Addresses on /24 subnets that are geographically concentrated are geolocated more accurately. We then characterize how quickly /24 subnets associated with fixed-line networks change geographic locations, and how long residential broadband ISP subscribers retain individual IP addresses. We find, generally, that most IP address assignments are stable over two months, although stability does vary across ISPs. Finally, we evaluate the suitability of existing IP geolocation databases for understanding Internet access and performance in human populations within specific geographies and demographics. Although the median accuracy of IP geolocation is better than 3 km in some contexts – fixed-line connections in New York City, for instance – we conclude that relying on IP geolocation databases to understand Internet access in densely populated regions such as cities is premature.

Given an IP address, it is a challenging task to obtain its geographic location. Besides approaches which associate coordinates with IP addresses in a predominantly static way, there are also measurement based approaches that exploit the correlation between the propagation delay of signals and round trip times of probe packets. We analyze multiple approaches solely based on delay measurements, i. e. without the use of third-party knowledge, and obtain mean errors of just under 100 km. In this paper, we propose a new model for IP geolocation which combines the strengths of different previous techniques and reduces IP geolocation to the problem of finding equilibrium points in a spring system. Our approach, called Spring-Based Geolocation (SBG), is able to reduce the mean error to less than 75km in our experiments without adding significant complexity. In fact, our model allows for additional data sources in a natural way, which has the potential to further improve results.

Overlay applications have used various tools to measure path properties in order to construct efficient overlay networks. Typical examples include delay measurement, connectivity measurement and residual bandwidth measurement. While different tools have different measurement targets, it is difficult to design general criterion for selecting paths to measure. In this paper, we study path properties and figure out some simple rules for path selection in measurements. We first examine the relationship between path delay and residual bandwidth. Our measurement results indicate that short paths often have high residual bandwidth. We then impose high preference on short paths in traceroute measurements. The results show that traceroute measurements with path preference achieve comparable inference efficiency and much lower overhead as compared to traditional traceroute measurements. Our study suggests that we can preferentially select short paths to measure. This can fulfill various requirements on path properties.

With the development of network, IP geolocation technology has been widely used. Nearly all of the previous IP geolocation technology depends on the delay information. And most of them are based on the assumption of strong correlation between network delay and the geographic distance. But in China the correlation is weak. That makes the IP geolocation precision very low. To improve the problem, we geolocate by using the closest-shortest rule (with high probability the shortest delay comes from the closest distance) and association rules. We also design the landmark filtering algorithm and router repairing algorithm. What's more, we evaluate the geolocation precision of 996 landmarks, and make the error value within 4 km, greatly improving the geolocation accuracy.

Estimation of network distances using off-line measurements

In this paper an accurate and efficient switch-level timing simulator is described. The high accuracy is attributed to a new waveform approximation technique, which includes delay estimation and slope estimation. Efficient delay and slope calculations are accomplished through a switch-level simulation instead of using a transistor-level simulation. A new approach for delay estimation is presented, and it models the delay behavior of an RC tree by two equations: a dominant delay equation and an offset delay equation. Both are derived by a special process to fit the surface built by experimental data measured from the actual delay behavior of a CMOS gate. The results show good agreement with SPICE.

Efficient measurement of round-trip link delays in software-defined networks

Measurement and Prediction of Communication Delays in Myrinet Networks

IP geolocation determines geographical location by the IP address of Internet hosts. IP geolocation is widely used by target advertising, online fraud detection, cyber-attacks attribution and so on. It has gained much more attentions in these years since more and more physical devices are connected to cyberspace. Most geolocation methods cannot resolve the geolocation accuracy for those devices with few landmarks around. In this paper, we propose a novel geolocation approach that is based on common routers as secondary landmarks (Common Routers-based Geolocation, CRG). We search plenty of common routers by topology discovery among web server landmarks. We use statistical learning to study localized (delay, hop)-distance correlation and locate these common routers. We locate the accurate positions of common routers and convert them as secondary landmarks to help improve the feasibility of our geolocation system in areas that landmarks are sparsely distributed. We manage to improve the geolocation accuracy and decrease the maximum geolocation error compared to one of the state-of-the-art geolocation methods. At the end of this paper, we discuss the reason of the efficiency of our method and our future research.