Spring-based geolocation

This paper uses two commercial datasets of IP addresses from smartphones, geolocated through the Global Positioning System (GPS), to characterize the geography of IP addresses from mobile and broadband ISPs. Datasets that geolocate IP addresses based on GPS offer superlative accuracy and precision for IP geolocation and thus provide an unprecedented opportunity to understand both the accuracy of existing geolocation databases as well as other properties of IP addresses, such as mobility and churn. We focus our analysis on three large cities in the United States.After evaluating the accuracy of existing geolocation databases, we analyze the circumstances under which IP geolocation databases may be more or less accurate. Within our sample, we find that geolocation databases are more accurate on fixed-line than mobile networks, that IP addresses on university networks can be more accurately located than those from consumer or business networks, and that often the paid versions of these databases are not significantly more accurate than the free versions. Addresses on /24 subnets that are geographically concentrated are geolocated more accurately. We then characterize how quickly /24 subnets associated with fixed-line networks change geographic locations, and how long residential broadband ISP subscribers retain individual IP addresses. We find, generally, that most IP address assignments are stable over two months, although stability does vary across ISPs. Finally, we evaluate the suitability of existing IP geolocation databases for understanding Internet access and performance in human populations within specific geographies and demographics. Although the median accuracy of IP geolocation is better than 3 km in some contexts – fixed-line connections in New York City, for instance – we conclude that relying on IP geolocation databases to understand Internet access in densely populated regions such as cities is premature.

Understanding user behavior via IP addresses is a crucial measure towards numerous pragmatic IP-based applications, including online content delivery, fraud prevention, marketing intelligence, and others. While profiling IP addresses through methods like IP geolocation and anomaly detection has been thoroughly studied, the function of an IP address—e.g., whether it pertains to a private enterprise network or a home broadband—remains underexplored. In this work, we initiate the first attempt to address the IP usage scenario classification problem. We collect data consisting of IP addresses from four large-scale regions. A novel continuous neural tree-based ensemble model is proposed to learn IP assignment rules and complex feature interactions. We conduct extensive experiments to evaluate our model in terms of classification accuracy and generalizability. Our results demonstrate that the proposed model is capable of efficiently uncovering significant higher-order feature interactions that enhance IP usage scenario classification, while also possessing the ability to generalize from the source region to the target one.

In this paper, we ask whether it is possible to build an IP address to geographic location mapping service for Internet hosts. Such a service would enable a large and interesting class of location-aware applications. This is a challenging problem because an IP address does not inherently contain an indication of location.We present and evaluate three distinct techniques, collectively referred to as IP2Geo, for determining the geographic location of Internet hosts. The first technique, Geo Track, infers location based on the DNS names of the target host or other nearby network nodes. The second technique, GeoPing, uses network delay measurements from geographically distributed locations to deduce the coordinates of the target host. The third technique, GeoCluster, combines partial (and possibly inaccurate) host-to-location mapping information and BGP prefix information to infer the location of the target host. Using extensive and varied data sets, we evaluate the performance of these techniques and identify fundamental challenges in deducing geographic location from the IP address of an Internet host.

Network measurement based modeling and optimization for IP geolocation

IP geolocation determines geographical location by the IP address of Internet hosts. IP geolocation is widely used by target advertising, online fraud detection, cyber-attacks attribution and so on. It has gained much more attentions in these years since more and more physical devices are connected to cyberspace. Most geolocation methods cannot resolve the geolocation accuracy for those devices with few landmarks around. In this paper, we propose a novel geolocation approach that is based on common routers as secondary landmarks (Common Routers-based Geolocation, CRG). We search plenty of common routers by topology discovery among web server landmarks. We use statistical learning to study localized (delay, hop)-distance correlation and locate these common routers. We locate the accurate positions of common routers and convert them as secondary landmarks to help improve the feasibility of our geolocation system in areas that landmarks are sparsely distributed. We manage to improve the geolocation accuracy and decrease the maximum geolocation error compared to one of the state-of-the-art geolocation methods. At the end of this paper, we discuss the reason of the efficiency of our method and our future research.

Geolocation techniques aim at determining the geographic location of an Internet host based on its IP address. Currently, measurement-based geolocation techniques disregard the buffering delays that may be introduced at each hop along the path taken by probe packets. To fill this gap, we propose the GeoBuD (Geolocation using Buffering Delay estimation) approach. Although the network delay and the geographic distance between two Internet hosts have been shown to be related to some extent, leveraging buffering delay estimation at each hop for geolocation purposes is challenging for two reasons. First, correctly estimating the buffering delay at intermediate hops along a traceroute path for geolocation purposes depends on the accurate estimation of the geolocation of the intermediate routers. Second, even given an a priori knowledge of the location of the routers, estimating the buffering delays is difficult due to the coarse-grained information provided by delay measurements. Relying on traceroute measurements, we show that leveraging buffering delay estimation improves accuracy in the measurement-based geolocation of Internet hosts as well as the confidence that the geolocation service associates to each estimation.Keywordsgeolocationbuffering delay estimationtraceroutemultilateration

<p>Accessing and retrieving users’ browser and network information is a common practice used by advertisers and many online services to deliver targeted ads and explicit improved services to users belonging to a particular group. They provide a great deal of information about a user’s geographical location, ethnicity, language, culture and general interests. However, in the same way these techniques have proven effective in advertising services, they can be used by attackers to launch targeted attacks against specific user groups. Targeted attacks have been proven more effective against user groups than their blind untargeted counterparts (e.g.spam, phishing). Their detection is more challenging as the detection tools need to be located within the targeted user group. This is one of the challenges faced by security researchers and organisations involved in the detection of new malware and exploits, using client honeypots. Client honeypots are detection systems used in the identification of malicious web sites. The client honeypot needs to mimic users in a pre-defined location, system, network and personality for which the malware is intended. The case is amplified by the use of Browser Exploit Packs/kits (BEPs), supporting these features. BEPs provide simplicity in deployment of targeted malicious web sites. They allow attackers to utilise specific geographical locations, network information, visit patterns or browser header information obtained from a visiting user to determine if a user should be subjected to an attack. Malicious web sites that operate based on targeted techniques can disguise themselves as legitimate web sites and bypass detection. Benign content is delivered to attacker-specified users while avoiding delivery to suspicious systems such as well-known or possible subnets that may host client honeypots. A client honeypot deployed in a single location with a single IP address will fail to detect an attack targeted at users in different demographic and network subnets. Failure in detection of such attacks results in high rates of false negatives which affect all honeypots regardless of detection technique or interaction level. BEPs are hugely popular and most include tracking features. The number of malicious web sites that utilise these features is currently unknown. There are very few studies that have addressed identifying the rate and number of malicious web sites utilising these techniques and no available client honeypot system is currently able to detect them. Any failure to detect these web sites will result in unknown numbers of users being exploited and infected with malware. The false negatives resulting from failing to detect these web sites can incorrectly be interpreted as a decline in the number of attacks. In this work, a study of information that can potentially expose users to targeted attack through a browser is examined through experimental analysis. Concrete approaches by attackers to obtain user-specific information in the deployment of targeted attacks through browsers are discussed and analysed. We propose a framework for designing a client honeypot capable of detecting geolocation attacks. Our framework relies on HAZard and OPerability (HAZOP) studies to identify components of the client honeypot, its processes and attributes of the experimental setup which could potentially introduce bias into our study. Any potential bias neglected, would affect the results of our real-world experiments and undermine our analysis through deviation from the intent of the study. To facilitate in our experiments, we developed a low interaction client honeypoy (YALIH) and performed real-world experiments on large selection of web sites. We determined the popularity of targeted malicious attacks based on likely attributes of a visiting user’s system. Our approach relies on previous research performed in the area of online spam detection which has similar attributes to malicious web sites. Our experiments show that referer, via, X-Forwarded-For and browser language attributes of HTTP protocol header, retrieval behaviour (i.e. IP tracking) and geographical location of a visitor identified by an IP address can be used in a targeted attack. These attributes can have significant effect on the number of detected malicious web sites in a study and should therefore be reliably controlled in an experimental setup. This findings in this research can potentially reduce false negative rates in all types of client honeypots, measurement studies of malicious malicious web sites and help researchers and malware analysts capture and analyse new malware and exploit samples from malicious web sites.</p>

Fraudulent use of network security tokens is a serious concern for any system that contains data that must be secured against illicit access, duplication, or manipulation. Anomaly-based techniques to classify logins as fraudulent or legitimate have been proposed and used successfully, however the lack of clear mathematical structure in the space of IP addresses means that many of these methods require significant supplemental information such as payload, failed token usages, or user activity upon the secured network in order to achieve accurate detection rates. When this additional information is not available, such as in network-based intrusion detection systems, many systems to detect fraudulent security token usage require a series of usages before a classification can be made. We present an anomaly detection system based upon IP addresses, a mapping of geographic location as inferred from IP address, and usage timestamps that is capable of identifying fraudulent token usage with as little as a single instance of fraudulent usage while overcoming the often significant limitations in geographic IP address mappings.

The Web as a large collection of pages is organized around a hierarchical domain system. For searching, analyzing or other purposes, selecting a subset from it is a challenging problem. In this paper, we address the issue of determining the pages related to a country as a subset. A Web page `belongs' to a national Web if it bears or represents identities from a particular country. Using the national domain such as .ae, .uk, as primary identifier and IP address, geographic locations, and language as augmented/secondary identifiers is no longer adequate. We propose a two-step Web page classifier (1) pre-crawl filter and (2) post-crawl filter. The former stage prunes out Web pages not belonging to the nation under investigation before fetching/downloading a Web page while the later stage filters irrelevant ones through a multiple-step analysis after downloading a page. We used the United Arab Emirates (UAE) national Web as a case study. We share our experience crawling the national Web, introduce the crawler designed to accomplish the task, and present some of our results and findings.

With the rise of digital transactions, e-Wallets have become prime targets for fraudulent activity. Early detection of suspicious transactions is therefore crucial to protect users and maintain trust in these systems. This article proposes a mathematical model based on a Mixed Integer Program (MIP) to identify and block suspicious transactions. This mathematical approach is designed to analyze e-Wallet transactions in real time by combining integer and continuous decision variables, offering greater flexibility in modeling fraud detection constraints. It considers parameters such as transaction cost, geographical location, type of device used for the transaction, IP address and other potential fraud indicators. Assigning suspicion scores to each transaction enables the model to identify risks that become habitual behavior and mark them as suspicious. Tests carried out on 10,000 digital transactions show that using PMNE significantly improves the detection of fraudulent transactions by identifying the most critical anomalies in terms of accuracy, adaptability and operational efficiency. The model also offers greater accuracy, reducing the number of false positives and false negatives, enabling faster intervention to block truly suspicious transactions.

Location-specific Internet services are predicated on the ability to identify the geographic position of IP hosts accurately. Fundamental to current state-of-the-art geolocation techniques is reliance on heavyweight traceroute-like probes that put a significant traffic load on networks. In this paper, we introduce a new lightweight approach to IP geolocation that we call Posit. This methodology requires only a small number of delay measurements conducted to end host targets in conjunction with a computationally-efficient statistical embedding technique. We demonstrate that Posit performs better than all existing geolocation tools across a wide spectrum of measurement infrastructures with varying geographic densities. Specifically, Posit is shown to geolocate hosts with median error improvements of over 55% with respect to all current measurement-based IP geolocation methodologies.

A whole new class of location-aware services may be envisaged by the deployment of a geographic location service for Internet hosts. We focus on a technique that relies on delay measurements and the exploitation of a possible correlation between geographic distance and network delay. Our investigation shows that such a correlation becomes stronger as connectivity becomes richer. Host locations are inferred by comparing delay patterns of geographically distributed landmarks (hosts with a known geographic location) with the delay pattern of the target host to be located. The problem we deal with is how to best measure the similarity between the delay patterns of the landmarks and the one observed for the target host. The location estimation of the target host is the location of the landmark that presents the most similar delay pattern with respect to the one of the target host. We define and evaluate three similarity models. Experiments show that the previously adopted Euclidean distance is outperformed by other similarity models, resulting in a more accurate Internet host location from delay measurements.

This paper describes a technique to determine electrical test temperature of devices made of conventional packages like QFP and BGA as well as new packaging technologies such as system-in-package (SIP) and wafer level packages. It is based on the signal propagation delays that are sensitive to temperatures within the chip. The technique was applied to a QFP device, fabricated in 0.35 micron technology, that operates at 25 MHz with an average power consumption of about 0.5 Watt. The package geometry and the test environment have been numerically modeled. The signal delay measurement results are found to agree with the estimates based on numerical modeling. This technique will be useful in direct evaluation of production test temperatures when the package geometry and test environment are harder to model.

The geographical locations of smart devices can help in providing authentication information between multimedia content providers and users in 5G networks. The IP geolocation methods can help in estimating the geographical location of these smart devices. The two key assumptions of existing IP geolocation methods are as follows: (1) the smallest relative delay comes from the nearest host; (2) the distance between hosts which share the closest common routers is smaller than others. However, the two assumptions are not always true in weakly connected networks, which may affect accuracy. We propose a novel street-level IP geolocation algorithm (Corr-SLG), which is based on the delay-distance correlation and multilayered common routers. The first key idea of Corr-SLG is to divide landmarks into different groups based on relative-delay-distance correlation. Different from previous methods, Corr-SLG geolocates the host based on the largest relative delay for the strongly negatively correlated groups. The second key idea is to introduce the landmarks which share multilayered common routers into the geolocation process, instead of only relying on the closest common routers. Besides, to increase the number of landmarks, a new street-level landmark collection method called WiFi landmark is also presented in this paper. The experiments in one province capital city of China, Zhengzhou, show that Corr-SLG can improve the geolocation accuracy remarkably in a real-world network.

Network entity landmark is the key foundation of IP geolocaiton which plays an important role in network security. Integrating multi-source landmarks to generate a landmark database with high IP coverage and high location accuracy is an important solution for improving the IP geolocation effect. However, the city-level landmarks provide the city name while street-level landmarks provide the latitude and longitude where they located. Owning to their inconsistent format, the state-of-art fusion algorithm cannot effectively integrate the two types of data. Hence, this paper proposes Lusion, a multi-source landmark fusion algorithm. We first extend the IP addresses in the landmark data sources, then model the location data of the two types of landmarks using the landmark location mixture model, and finally use the expectation -maximization algorithm to estimate the location of the landmarks. The simulation experiments on 25 landmark data sources show that the algorithm can effectively integrate the city-level and street-level landmarks from different data sources, and have a significantly better performance than the original data sources in the location accuracy. Furthermore, we evaluate Lusion on real-world datasets, which consists of 7 city-level and 3 street-level landmark data sources, by locating 100 IP addresses in Hong Kong and Zhengzhou respectively. The geolocation results show that Lusion increased the city-level accuracy by at least 8 percentage points compared with the original data sources, and reduces the geolocation error from 3.42 km to 2.92 km based on the best original landmark data set.