Target driven IP Geolocation Algorithm

Abstract

IP Golocation is an important technique to achieve network attack traceability, network security early warning, and improve the ability of cyberspace governance. Due to the limitation of collecting a large number of anchor nodes, it is impossible to accurately infer the IP location to block level or more in a large scale. Therefore, this paper proposes a target driven IP geolocation inference method. Firstly, the candidate anchor node is collected from the subnet or the adjacent subnet of the target IP, then the candidate anchor node is calibrated by their fingerprints, and finally the geolocation of target IP is comprehensively inference by its proximity to anchors. In order to verify the proposed method, 10,000 IPs in Beijing is selected randomly. The experimental results show that the method can effectively infer the geographical location of the target IP address.