MLAR:面向IP定位的大规模网络别名解析  

MLAR:large-scale network alias resolution for IP geolocation

作　　者：袁福祥 刘粉林[1,2] 刘翀 刘琰 罗向阳[1,2] YUAN Fuxiang;LIU Fenlin;LIU Chong;LIU Yan;LUO Xiangyang(School of Cyberspace Security,Information Engineering University,Zhengzhou 450001,China;State Key Laboratory of Mathematical Engineering and Advanced Computing,Zhengzhou 450001,China)

机构地区：[1]信息工程大学网络空间安全学院,河南郑州450001 [2]数学工程与先进计算国家重点实验室,河南郑州450001

出　　处：《网络与信息安全学报》2020年第4期77-94,共18页Chinese Journal of Network and Information Security

基　　金：国家自然科学基金(U1636219,U1736214,U1804263);国家重点研发计划(2016YFB0801303,2016QY01W0105);河南省科技创新杰出人才计划(184200510018)。

摘　　要：为准确高效地对接口IP进行别名解析,支撑IP定位,提出一种大规模网络别名解析算法(MLAR)。基于别名IP与非别名IP的时延、路径、Whois等的统计差异,设计过滤规则,在解析前排除大量不可能存在别名关系的IP,提高解析的效率;将别名解析转化为分类,构建时延相似度、路径相似度等四维新颖的特征,用于过滤后可能的别名IP和非别名IP的分类。基于CAIDA百万级样本的实验表明,相比RadarGun、MIDAR、TreeNET,正确率提高15.8%、4.8%、5.7%,耗时最多降低77.8%、65.3%、55.2%;在应用于IP定位时,SLG、LENCR、PoPG这3种典型定位方法的失败率降低65.5%、64.1%、58.1%。In order to accurately and efficiently perform alias resolution on interface IP and support IP geolocation,a large-scale network alias resolution algorithm(MLAR)was proposed.Based on the statistical differences in delays,paths,Whois,etc.between alias IP and non-alias IP,before resolution,filtering rules were designed to exclude a large number of IPs that can not be aliases and improve efficiency of resolution,alias resolution was transformed into classification,and four novel features such as delay similarity,path similarity,etc.were constructed for the classification of possible alias IP and non-alias IP after filtering.Experiments based on millions of samples from CAIDA show that compared with RadarGun,MIDAR,and TreeNET,the accuracy is improved by 15.8%,4.8%,5.7%,the time consumption can be reduced by up to 77.8%,65.3%,and 55.2%,when the proposed algorithm is applied to IP geolocation,the failure rates of the three typical geolocation methods such as SLG,LENCR,and PoPG are reduced by about 65.5%,64.1%,and 58.1%.

关 键 词：别名解析 IP定位 网络拓扑 网络测量 机器学习 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]