IP to Geo-location Mapping Using Multiple Measurement Framework.

Abstract

Geolocation information for an IP can be used for various applications over the internet, like content delivery, advertising, fraud detection, & prevention. It can also be helpful in cyber security on both the offensive and defensive side. Finding the bad actors behind an attack or getting information about a target during penetration testing can also be done with the help of IP to Geolocation. Over the years, geolocating an IP has been done via different methods in which anchors, monitors, and landmarks play an important role. But geolocation for an IP can be easily faked and not accurate for numerous reasons, one of which is the lack of high quality landmarks and their filtration due to delay problems in active measurements (traceroute & ping). The existing work on IP geolocation has provided many new approaches that can be used to eliminate problems of limited visible landmarks and delay-distance relations. The existing work still lacks improvements, especially related to delay-distance relations to get an accurate distance between the target and landmarks, or between landmarks. The aforementioned problems can arise because of poor communication technology; data traffic over the network may cause packet delays and replay times at their destination, which depends on software and hardware configuration, and the number of nodes present between host and destination may provide unnecessary routes for data packet travel. In this work, we focused on the availability of quality and promising landmarks. Online available CCTVs are used as landmarks, and we present a new multiple framework with a unique shortlisting algorithm to get the most nearby landmarks to the target to help locate the precise region of the target. The system periodically fetches high-quality landmarks, delays, and topology constraints along with the landmarks. The new framework uses a shared-path geolocation approach with a new algorithm for filtration (short-listing algorithm) to approximately hit the precise region of a target. A beta version of the system has been developed, and multiple experiments have been conducted to validate the reported accuracy. The results show that our approach, compared with existing algorithms, outperformed them. The evaluation results also show that prior algorithms can be significantly improved by using our proposed method for selecting landmarks and its associated shortlisting algorithm