IP geolocation base on local delay distribution similarity

Abstract

IP geolocation technology can be used to obtain the real-time locations of target Internet hosts especially mobile computers, which can help law enforcement to quickly get the criminal evidence or arrest criminals. Among existing numerous geolocation methods, SLG (Street-Level Geolocation) method can achieve geolocation result with relative higher precision for a target host. However, the geolocation accuracy will be significantly reduced once the common routers that play an important role in geolocation are anonymous, which often happens in paths detection. To solve this problem, this paper proposes an IP geolocation algorithm base on local delay distribution similarity. Firstly, the target’s location at city-level granularity is obtained based on traditional SLG method. Secondly, the landmarks connected with the target by common routers are found out by topology analysis. The target’s local delay between the nearest common router and the target is gained by multi-measurement and calculation, so do the landmarks’. Thirdly, their local delay distribution is obtained by statistical analysis. Lastly, the landmark whose local delay distribution is the most similar with the target’s is selected as the estimated location of the target. Experimental results show that the proposed algorithm obviously improves the geolocation accuracy compared with traditional SLG when the common routers are anonymous.