IP2vec:an IP node representation model for IP geolocation  

作　　者：Fan ZHANG Meijuan YIN Fenlin LIU Xiangyang LUO Shuodi ZU 

机构地区：[1]State Key Laboratory of Mathematical Engineering and Advanced Computing,Zhengzhou 450001,China [2]Key Laboratory of Cyberspace Situation Awareness of Henan Province,Zhengzhou 450001,China

出　　处：《Frontiers of Computer Science》2024年第6期189-204,共16页计算机科学前沿（英文版）

基　　金：the National Natural Science Foundation of China(Grant Nos.U1804263,U1736214,62172435);the Zhongyuan Science and Technology Innovation Leading Talent Project(No.214200510019)。

摘　　要：IP geolocation is essential for the territorial analysis of sensitive network entities,location-based services(LBS)and network fraud detection.It has important theoretical significance and application value.Measurement-based IP geolocation is a hot research topic.However,the existing IP geolocation algorithms cannot effectively utilize the distance characteristics of the delay,and the nodes’connection relation,resulting in high geolocation error.It is challenging to obtain the mapping between delay,nodes’connection relation,and geographical location.Based on the idea of network representation learning,we propose a representation learning model for IP nodes(IP2vec for short)and apply it to street-level IP geolocation.IP2vec model vectorizes nodes according to the connection relation and delay between nodes so that the IP vectors can reflect the distance and topological proximity between IP nodes.The steps of the street-level IP geolocation algorithm based on IP2vec model are as follows:Firstly,we measure landmarks and target IP to obtain delay and path information to construct the network topology.Secondly,we use the IP2vec model to obtain the IP vectors from the network topology.Thirdly,we train a neural network to fit the mapping relation between vectors and locations of landmarks.Finally,the vector of target IP is fed into the neural network to obtain the geographical location of target IP.The algorithm can accurately infer geographical locations of target IPs based on delay and topological proximity embedded in the IP vectors.The cross-validation experimental results on 10023 target IPs in New York,Beijing,Hong Kong,and Zhengzhou demonstrate that the proposed algorithm can achieve street-level geolocation.Compared with the existing algorithms such as Hop-Hot,IP-geolocater and SLG,the mean geolocation error of the proposed algorithm is reduced by 33%,39%,and 51%,respectively.

关 键 词：IP geolocation network measurement node embedding 

分 类 号：TP393.04[自动化与计算机技术—计算机应用技术]