MLAR:large-scale network alias resolution for IP geolocation

Fuxiang YUAN; Fenlin LIU; Chong LIU; Yan LIU; Xiangyang LUO

doi:10.11959/j.issn.2096-109x.2020044

您当前的位置：

首页 >

文章列表页 >

MLAR:large-scale network alias resolution for IP geolocation

Papers | 更新时间：2024-06-03

- MLAR:large-scale network alias resolution for IP geolocation
- Chinese Journal of Network and Information Security Vol. 6, Issue 4, Pages: 77-94(2020)
- 作者机构：
  
  1. 信息工程大学网络空间安全学院，河南郑州 450001
  2. 数学工程与先进计算国家重点实验室，河南郑州 450001
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2020044
  CLC： TP393
- Online First：2020-08，
  
  Published：15 August 2020
- 稿件说明：
移动端阅览
Fuxiang YUAN, Fenlin LIU, Chong LIU, et al. MLAR:large-scale network alias resolution for IP geolocation[J]. Chinese Journal of Network and Information Security, 2020, 6(4): 77-94.
DOI：

Fuxiang YUAN, Fenlin LIU, Chong LIU, et al. MLAR:large-scale network alias resolution for IP geolocation[J]. Chinese Journal of Network and Information Security, 2020, 6(4): 77-94. DOI： 10.11959/j.issn.2096-109x.2020044.

摘要

为准确高效地对接口 IP 进行别名解析，支撑 IP 定位，提出一种大规模网络别名解析算法（MLAR）。基于别名IP与非别名IP的时延、路径、Whois等的统计差异，设计过滤规则，在解析前排除大量不可能存在别名关系的 IP，提高解析的效率；将别名解析转化为分类，构建时延相似度、路径相似度等四维新颖的特征，用于过滤后可能的别名IP和非别名IP的分类。基于CAIDA百万级样本的实验表明，相比 RadarGun、MIDAR、TreeNET，正确率提高 15.8%、4.8%、5.7%，耗时最多降低 77.8%、65.3%、55.2%；在应用于 IP 定位时，SLG、LENCR、PoPG 这 3 种典型定位方法的失败率降低 65.5%、64.1%、58.1%。

Abstract

In order to accurately and efficiently perform alias resolution on interface IP and support IP geolocation

a large-scale network alias resolution algorithm (MLAR) was proposed.Based on the statistical differences in delays

paths

Whois

etc.between alias IP and non-alias IP

before resolution

filtering rules were designed to exclude a large number of IPs that can not be aliases and improve efficiency of resolution

alias resolution was transformed into classification

and four novel features such as delay similarity

path similarity

etc.were constructed for the classification of possible alias IP and non-alias IP after filtering.Experiments based on millions of samples from CAIDA show that compared with RadarGun

MIDAR

and TreeNET

the accuracy is improved by 15.8%

4.8%

5.7%

the time consumption can be reduced by up to 77.8%

65.3%

and 55.2%

when the proposed algorithm is applied to IP geolocation

the failure rates of the three typical geolocation methods such as SLG

LENCR

and PoPG are reduced by about 65.5%

64.1%

and 58.1%.

关键词

Keywords

references

CANBAZ M A . Internet topology mining:from big data to network science [D ] . Reno:University of Nevada , 2018 .

KARDES H , GUNES M H , SARAC K . Graph based induction of unresponsive routers in internet topologies [J ] . Computer Networks , 2015 , 81 : 178 - 200 .

COSKUN I E , CANBAZ M A , GUNES M H . Efficient AS network topology measurement based on ingress to subnet reachability [C ] // IEEE 41st Conference on Local Computer Networks Workshops . 2016 : 87 - 95 .

WANG Y , BURGENER D , FLORES M , et al . Towards street-level client-independent IP geolocation [C ] // Symposium on Network System Design and Implementation . 2011 : 27 - 27 .

CHEN J , LIU F , SHI Y , et al . Towards IP location estimation using the nearest common router [J ] . Journal of Internet Technology , 2018 , 19 ( 7 ): 2097 - 2110 .

YUAN F , LIU F , HUANG D , et al . A high completeness PoP partition algorithm for IP geolocation [J ] . IEEE Access , 2019 , 7 : 28340 - 28355 .

KEYS K . Internet-scale IP alias resolution techniques [J ] . ACM Sigcomm Computer Communication Review , 2010 , 40 ( 1 ): 50 - 55 .

MARCHETTA P , PESCAPÉ A , . DRAGO:detecting,quantifying and locating hidden routers in traceroute IP paths [C ] // Proceedings IEEE International Conference on Computer Communications . 2013 : 3237 - 3242 .

LI R , SUN Y , HU J , et al . Street-level landmark evaluation based on nearest routers [J ] . Security and Communication Networks , 2018 ( 2 ): 1 - 12 .

HINGANT J , ZAMBRANO M , PÉREZ F J , et al . HYBINT:a hybrid intelligence system for critical infrastructures protection [J ] . Security and Communication Networks , 2018

方滨兴 . 从层次角度看网络空间安全技术的覆盖领域 [J ] . 网络与信息安全学报 , 2015 , 1 ( 1 ): 2 - 7 .

FANG B X . A hierarchy model on the research fields of cyberspace security technology [J ] . Chinese Journal of Network and Infor-mation Security , 2015 , 1 ( 1 ): 2 - 7 .

赵帆 , 罗向阳 , 刘粉林 . 网络空间测绘技术研究 [J ] . 网络与信息安全学报 , 2016 , 2 ( 9 ): 1 - 11 .

ZHAO F , LUO X Y , LIU F L . Research on cyberspace surveying and mapping technology [J ] . Chinese Journal of Network and In-formation Security , 2016 , 2 ( 9 ): 1 - 11 .

李欲晓 , 谢永江 . 世界各国网络安全战略分析与启示 [J ] . 网络与信息安全学报 , 2016 , 2 ( 1 ): 1 - 5 .

LI Y X , XIE Y J . Analysis and enlightenment on the cybersecurity strategy of various countries in the world [J ] . Chinese Journal of Network and Information Security , 2016 , 2 ( 1 ): 1 - 5 .

郭莉 , 曹亚男 , 苏马婧 , 等 . 网络空间资源测绘:概念与技术 [J ] . 信息安全学报 , 2018 , 3 ( 4 ): 1 - 14 .

GUO L , CAO Y , SU M J , et al . Cyberspace resources surveying and mapping:the concepts and technologies [J ] . Journal of Cyber security , 2018 , 3 ( 4 ): 1 - 14 .

王松 , 张野 , 吴亚东 . 网络拓扑结构可视化方法研究与发展 [J ] . 网络与信息安全学报 , 2018 , 4 ( 2 ): 1 - 17 .

WANG S , ZHANG Y , WU Y D . Survey on network topology visu-alization [J ] . Chinese Journal of Network and Information Security , 2018 , 4 ( 2 ): 1 - 17 .

GOVINDAN R , TANGMUNARUNKIT H . Heuristics for internet map discovery [C ] // Proceedings IEEE International Conference on Computer Communications . 2000 : 1371 - 1380 .

KEYS K . Iffinder,a tool for mapping interfaces to routers [EB ] .

SPRING N , MAHAJAN R , WETHERALL D . Measuring ISP topologies with rocketfuel [J ] . ACM Sigcomm Computer Communication Review , 2002 , 32 ( 4 ): 133 - 145 .

BENDER A , SHERWOOD R , SPRING N . Fixing ally's growing pains with velocity modeling [C ] // Proceedings of the 8th ACM Sigcomm Conference on Internet Measurement . 2008 : 337 - 342 .

KEYS K , HYUN Y , LUCKIE M , et al . Internet-scale IPv4 alias resolution with MIDAR [J ] . IEEE/ACM Transactions on Networking , 2013 , 21 ( 2 ): 383 - 399 .

SHERWOOD R , SPRING N . Touring the internet in a TCP sidecar [C ] // Proceedings of the 6th ACM Sigcomm Conference on Internet Measurement . 2006 : 339 - 344 .

SHERRY J , KATZ-BASSETT E , PIMENOVA M , et al . Resolving IP aliases with prespecified timestamps [C ] // Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement . 2010 : 172 - 178 .

MARCHETTA P , PERSICO V , PESCAPÈ A . Pythia:yet another active probing technique for alias resolution [C ] // Proceedings of the 9th ACM Conference on Emerging Networking Experiments and Technologies . 2013 : 229 - 234 .

GRAILET J F , DONNET B . Towards a renewed alias resolution with space search reduction and IP fingerprinting [C ] // Network Traffic Measurement and Analysis Conference . 2017 : 1 - 9 .

GUNES M H , SARAC K . Analytical IP alias resolution [C ] // IEEE International Conference on Communications . 2006 : 459 - 464 .

AUGUSTIN B , CUVELLIER X , ORGOGOZO B , et al . Avoiding traceroute anomalies with paris traceroute [C ] // Proceedings of the 6th ACM SIGCOMM Conference on Internet Measurement . 2006 : 153 - 158 .

SPRING N , DONTCHEVA M , RODRIG M , et al . How to resolve IP aliases [D ] . Seattle:University of Washington , 2004 .

赵洪华 , 白华利 , 陈鸣 , 等 . 别名解析中的别名过滤技术 [J ] . 软件学报 , 2009 ( 8 ): 2280 - 2288 .

ZHAO H , BAI H L , CHEN M , et al . Alias filtering technique in alias resolution [J ] . Journal of Software , 2009 ( 8 ): 2280 - 2288 .

TOZAL M , SARAC K . TraceNET:an internet topology data collector [C ] // Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement . 2010 : 356 - 368 .

PADMANABHAN V N , SUBRAMANIAN L . An investigation of geographic mapping techniques for internet hosts [J ] . ACM SIGCOMM Computer Communication Review , 2001 , 31 ( 4 ): 173 - 185 .

GUEYE B , ZIVIANI A , CROVELLA M , et al . Constraint-based geolocation of internet hosts [J ] . IEEE/ACM Transactions on Networking , 2006 , 14 ( 6 ): 1219 - 1232 .

SCHAPIRA M , ZHU Y , REXFORD J . Putting BGP on the right path:a case for next-hop routing [C ] // Proceedings of the 9th ACM SIGCOMM Workshop on Hot Topics in Networks . 2010 :3.

LENCSE G , RÉPÁS S , . Performance analysis and comparison of different DNS64 implementations for linux,openBSD and freeBSD [C ] // IEEE 27th International Conference on Advanced Information Networking and Applications . 2013 : 877 - 884 .

ZHAO F , LUO X , GAN Y , et al . IP geolocation based on identification routers and local delay distribution similarity [J ] . Concurrency and Computation:Practice and Experience , 2018 : 1 - 15 .

Views

357

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Adaptive IP geolocation framework for target network scenarios

Anomaly detection in DNS: an empirical study

Research progress on detection of software vulnerabilities based on code similarity

method for machine learning backdoor attacks based on defense method based on diffusion models

Personal data privacy protection method based onvertical partitioning

Related Author

Shichang DING

Fuxiang YUAN

Xiangyang LUO

Shuodi ZU

ZUO Peng

HOU Ronghao

CHEN Yong

KONG Kaichuan

Related Institution

Information Engineering University

Key Laboratory of Cyberspace Situation Awareness of Henan Province

China Internet Network Information Center

School of Cyber Science and Engineering, Jinan University

School of Medical Information, Wannan Medical College

⁰