MLAR：面向IP定位的大规模网络别名解析

袁福祥; 刘粉林; 刘翀; 刘琰; 罗向阳

doi:10.11959/j.issn.2096-109x.2020044

您当前的位置：

首页 >

文章列表页 >

MLAR：面向IP定位的大规模网络别名解析

学术论文 | 更新时间：2024-06-03

- MLAR：面向IP定位的大规模网络别名解析
- MLAR:large-scale network alias resolution for IP geolocation
- 网络与信息安全学报 2020年6卷第4期页码：77-94
- 作者机构：
  
  1. 信息工程大学网络空间安全学院，河南郑州 450001
  2. 数学工程与先进计算国家重点实验室，河南郑州 450001
- 作者简介：
  
  [ "袁福祥（1991- ），男，山东济宁人，信息工程大学博士生，主要研究方向为网络空间资源测绘与IP定位" ]
  [ "刘粉林（1964- ），男，江苏溧阳人，博士，信息工程大学教授、博士生导师，主要研究方向为网络空间安全" ]
  [ "刘翀（1994- ），男，辽宁抚顺人，信息工程大学硕士生，主要研究方向为网络空间资源测绘与IP定位" ]
  [ "刘琰（1979- ），女，山东济南人，博士，信息工程大学副教授，主要研究方向为网络空间安全" ]
  [ "罗向阳（1978- ），男，湖北荆门人，博士，信息工程大学教授、博士生导师，主要研究方向为网络空间安全" ]
- 基金信息：
  
  国家自然科学基金;The National Natural Science Foundation of China(U1636219);国家自然科学基金;The National Natural Science Foundation of China(U1736214);国家自然科学基金;The National Natural Science Foundation of China(U1804263);国家重点研发计划;The National Key R＆D Program of China(2016YFB0801303);国家重点研发计划;The National Key R＆D Program of China(2016QY01W0105);河南省科技创新杰出人才计划;The Plan for Scientific Innovation Talent of Henan Province(184200510018)
- DOI：10.11959/j.issn.2096-109x.2020044
  中图分类号： TP393
- 网络首发：2020-08，
  
  纸质出版：2020-08-15
- 稿件说明：
移动端阅览
袁福祥, 刘粉林, 刘翀, 等. MLAR：面向IP定位的大规模网络别名解析[J]. 网络与信息安全学报, 2020,6(4):77-94.

Fuxiang YUAN, Fenlin LIU, Chong LIU, et al. MLAR:large-scale network alias resolution for IP geolocation[J]. Chinese Journal of Network and Information Security, 2020, 6(4): 77-94.
袁福祥, 刘粉林, 刘翀, 等. MLAR：面向IP定位的大规模网络别名解析[J]. 网络与信息安全学报, 2020,6(4):77-94. DOI： 10.11959/j.issn.2096-109x.2020044.

Fuxiang YUAN, Fenlin LIU, Chong LIU, et al. MLAR:large-scale network alias resolution for IP geolocation[J]. Chinese Journal of Network and Information Security, 2020, 6(4): 77-94. DOI： 10.11959/j.issn.2096-109x.2020044.

摘要

为准确高效地对接口 IP 进行别名解析，支撑 IP 定位，提出一种大规模网络别名解析算法（MLAR）。基于别名IP与非别名IP的时延、路径、Whois等的统计差异，设计过滤规则，在解析前排除大量不可能存在别名关系的 IP，提高解析的效率；将别名解析转化为分类，构建时延相似度、路径相似度等四维新颖的特征，用于过滤后可能的别名IP和非别名IP的分类。基于CAIDA百万级样本的实验表明，相比 RadarGun、MIDAR、TreeNET，正确率提高 15.8%、4.8%、5.7%，耗时最多降低 77.8%、65.3%、55.2%；在应用于 IP 定位时，SLG、LENCR、PoPG 这 3 种典型定位方法的失败率降低 65.5%、64.1%、58.1%。

Abstract

In order to accurately and efficiently perform alias resolution on interface IP and support IP geolocation

a large-scale network alias resolution algorithm (MLAR) was proposed.Based on the statistical differences in delays

paths

Whois

etc.between alias IP and non-alias IP

before resolution

filtering rules were designed to exclude a large number of IPs that can not be aliases and improve efficiency of resolution

alias resolution was transformed into classification

and four novel features such as delay similarity

path similarity

etc.were constructed for the classification of possible alias IP and non-alias IP after filtering.Experiments based on millions of samples from CAIDA show that compared with RadarGun

MIDAR

and TreeNET

the accuracy is improved by 15.8%

4.8%

5.7%

the time consumption can be reduced by up to 77.8%

65.3%

and 55.2%

when the proposed algorithm is applied to IP geolocation

the failure rates of the three typical geolocation methods such as SLG

LENCR

and PoPG are reduced by about 65.5%

64.1%

and 58.1%.

关键词

Keywords

references

CANBAZ M A . Internet topology mining:from big data to network science [D ] . Reno:University of Nevada , 2018 .

KARDES H , GUNES M H , SARAC K . Graph based induction of unresponsive routers in internet topologies [J ] . Computer Networks , 2015 , 81 : 178 - 200 .

COSKUN I E , CANBAZ M A , GUNES M H . Efficient AS network topology measurement based on ingress to subnet reachability [C ] // IEEE 41st Conference on Local Computer Networks Workshops . 2016 : 87 - 95 .

WANG Y , BURGENER D , FLORES M , et al . Towards street-level client-independent IP geolocation [C ] // Symposium on Network System Design and Implementation . 2011 : 27 - 27 .

CHEN J , LIU F , SHI Y , et al . Towards IP location estimation using the nearest common router [J ] . Journal of Internet Technology , 2018 , 19 ( 7 ): 2097 - 2110 .

YUAN F , LIU F , HUANG D , et al . A high completeness PoP partition algorithm for IP geolocation [J ] . IEEE Access , 2019 , 7 : 28340 - 28355 .

KEYS K . Internet-scale IP alias resolution techniques [J ] . ACM Sigcomm Computer Communication Review , 2010 , 40 ( 1 ): 50 - 55 .

MARCHETTA P , PESCAPÉ A , . DRAGO:detecting,quantifying and locating hidden routers in traceroute IP paths [C ] // Proceedings IEEE International Conference on Computer Communications . 2013 : 3237 - 3242 .

LI R , SUN Y , HU J , et al . Street-level landmark evaluation based on nearest routers [J ] . Security and Communication Networks , 2018 ( 2 ): 1 - 12 .

HINGANT J , ZAMBRANO M , PÉREZ F J , et al . HYBINT:a hybrid intelligence system for critical infrastructures protection [J ] . Security and Communication Networks , 2018

方滨兴 . 从层次角度看网络空间安全技术的覆盖领域 [J ] . 网络与信息安全学报 , 2015 , 1 ( 1 ): 2 - 7 .

FANG B X . A hierarchy model on the research fields of cyberspace security technology [J ] . Chinese Journal of Network and Infor-mation Security , 2015 , 1 ( 1 ): 2 - 7 .

赵帆 , 罗向阳 , 刘粉林 . 网络空间测绘技术研究 [J ] . 网络与信息安全学报 , 2016 , 2 ( 9 ): 1 - 11 .

ZHAO F , LUO X Y , LIU F L . Research on cyberspace surveying and mapping technology [J ] . Chinese Journal of Network and In-formation Security , 2016 , 2 ( 9 ): 1 - 11 .

李欲晓 , 谢永江 . 世界各国网络安全战略分析与启示 [J ] . 网络与信息安全学报 , 2016 , 2 ( 1 ): 1 - 5 .

LI Y X , XIE Y J . Analysis and enlightenment on the cybersecurity strategy of various countries in the world [J ] . Chinese Journal of Network and Information Security , 2016 , 2 ( 1 ): 1 - 5 .

郭莉 , 曹亚男 , 苏马婧 , 等 . 网络空间资源测绘:概念与技术 [J ] . 信息安全学报 , 2018 , 3 ( 4 ): 1 - 14 .

GUO L , CAO Y , SU M J , et al . Cyberspace resources surveying and mapping:the concepts and technologies [J ] . Journal of Cyber security , 2018 , 3 ( 4 ): 1 - 14 .

王松 , 张野 , 吴亚东 . 网络拓扑结构可视化方法研究与发展 [J ] . 网络与信息安全学报 , 2018 , 4 ( 2 ): 1 - 17 .

WANG S , ZHANG Y , WU Y D . Survey on network topology visu-alization [J ] . Chinese Journal of Network and Information Security , 2018 , 4 ( 2 ): 1 - 17 .

GOVINDAN R , TANGMUNARUNKIT H . Heuristics for internet map discovery [C ] // Proceedings IEEE International Conference on Computer Communications . 2000 : 1371 - 1380 .

KEYS K . Iffinder,a tool for mapping interfaces to routers [EB ] .

SPRING N , MAHAJAN R , WETHERALL D . Measuring ISP topologies with rocketfuel [J ] . ACM Sigcomm Computer Communication Review , 2002 , 32 ( 4 ): 133 - 145 .

BENDER A , SHERWOOD R , SPRING N . Fixing ally's growing pains with velocity modeling [C ] // Proceedings of the 8th ACM Sigcomm Conference on Internet Measurement . 2008 : 337 - 342 .

KEYS K , HYUN Y , LUCKIE M , et al . Internet-scale IPv4 alias resolution with MIDAR [J ] . IEEE/ACM Transactions on Networking , 2013 , 21 ( 2 ): 383 - 399 .

SHERWOOD R , SPRING N . Touring the internet in a TCP sidecar [C ] // Proceedings of the 6th ACM Sigcomm Conference on Internet Measurement . 2006 : 339 - 344 .

SHERRY J , KATZ-BASSETT E , PIMENOVA M , et al . Resolving IP aliases with prespecified timestamps [C ] // Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement . 2010 : 172 - 178 .

MARCHETTA P , PERSICO V , PESCAPÈ A . Pythia:yet another active probing technique for alias resolution [C ] // Proceedings of the 9th ACM Conference on Emerging Networking Experiments and Technologies . 2013 : 229 - 234 .

GRAILET J F , DONNET B . Towards a renewed alias resolution with space search reduction and IP fingerprinting [C ] // Network Traffic Measurement and Analysis Conference . 2017 : 1 - 9 .

GUNES M H , SARAC K . Analytical IP alias resolution [C ] // IEEE International Conference on Communications . 2006 : 459 - 464 .

AUGUSTIN B , CUVELLIER X , ORGOGOZO B , et al . Avoiding traceroute anomalies with paris traceroute [C ] // Proceedings of the 6th ACM SIGCOMM Conference on Internet Measurement . 2006 : 153 - 158 .

SPRING N , DONTCHEVA M , RODRIG M , et al . How to resolve IP aliases [D ] . Seattle:University of Washington , 2004 .

赵洪华 , 白华利 , 陈鸣 , 等 . 别名解析中的别名过滤技术 [J ] . 软件学报 , 2009 ( 8 ): 2280 - 2288 .

ZHAO H , BAI H L , CHEN M , et al . Alias filtering technique in alias resolution [J ] . Journal of Software , 2009 ( 8 ): 2280 - 2288 .

TOZAL M , SARAC K . TraceNET:an internet topology data collector [C ] // Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement . 2010 : 356 - 368 .

PADMANABHAN V N , SUBRAMANIAN L . An investigation of geographic mapping techniques for internet hosts [J ] . ACM SIGCOMM Computer Communication Review , 2001 , 31 ( 4 ): 173 - 185 .

GUEYE B , ZIVIANI A , CROVELLA M , et al . Constraint-based geolocation of internet hosts [J ] . IEEE/ACM Transactions on Networking , 2006 , 14 ( 6 ): 1219 - 1232 .

SCHAPIRA M , ZHU Y , REXFORD J . Putting BGP on the right path:a case for next-hop routing [C ] // Proceedings of the 9th ACM SIGCOMM Workshop on Hot Topics in Networks . 2010 :3.

LENCSE G , RÉPÁS S , . Performance analysis and comparison of different DNS64 implementations for linux,openBSD and freeBSD [C ] // IEEE 27th International Conference on Advanced Information Networking and Applications . 2013 : 877 - 884 .

ZHAO F , LUO X , GAN Y , et al . IP geolocation based on identification routers and local delay distribution similarity [J ] . Concurrency and Computation:Practice and Experience , 2018 : 1 - 15 .

浏览量

357

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

目标网络场景自适应的IP定位框架

DNS异常检测：大规模实验分析

基于代码相似性的软件漏洞检测研究进展

基于扩散模型的机器学习后门攻击防御方法

基于垂直分割的个人数据隐私保护方法