网络与信息安全学报 ›› 2020, Vol. 6 ›› Issue (4): 77-94.doi: 10.11959/j.issn.2096-109x.2020044

• 学术论文 • 上一篇    下一篇

MLAR:面向IP定位的大规模网络别名解析

袁福祥1,2(),刘粉林1,2,刘翀1,2,刘琰1,2,罗向阳1,2   

  1. 1 信息工程大学网络空间安全学院,河南 郑州 450001
    2 数学工程与先进计算国家重点实验室,河南 郑州 450001
  • 修回日期:2020-03-19 出版日期:2020-08-15 发布日期:2020-08-13
  • 作者简介:袁福祥(1991- ),男,山东济宁人,信息工程大学博士生,主要研究方向为网络空间资源测绘与IP定位|刘粉林(1964- ),男,江苏溧阳人,博士,信息工程大学教授、博士生导师,主要研究方向为网络空间安全|刘翀(1994- ),男,辽宁抚顺人,信息工程大学硕士生,主要研究方向为网络空间资源测绘与IP定位|刘琰(1979- ),女,山东济南人,博士,信息工程大学副教授,主要研究方向为网络空间安全|罗向阳(1978- ),男,湖北荆门人,博士,信息工程大学教授、博士生导师,主要研究方向为网络空间安全
  • 基金资助:
    国家自然科学基金(U1636219);国家自然科学基金(U1736214);国家自然科学基金(U1804263);国家重点研发计划(2016YFB0801303);国家重点研发计划(2016QY01W0105);河南省科技创新杰出人才计划(184200510018)

MLAR:large-scale network alias resolution for IP geolocation

Fuxiang YUAN1,2(),Fenlin LIU1,2,Chong LIU1,2,Yan LIU1,2,Xiangyang LUO1,2   

  1. 1 School of Cyberspace Security,Information Engineering University,Zhengzhou 450001,China
    2 State Key Laboratory of Mathematical Engineering and Advanced Computing,Zhengzhou 450001,China
  • Revised:2020-03-19 Online:2020-08-15 Published:2020-08-13
  • Supported by:
    The National Natural Science Foundation of China(U1636219);The National Natural Science Foundation of China(U1736214);The National Natural Science Foundation of China(U1804263);The National Key R&D Program of China(2016YFB0801303);The National Key R&D Program of China(2016QY01W0105);The Plan for Scientific Innovation Talent of Henan Province(184200510018)

摘要:

为准确高效地对接口 IP 进行别名解析,支撑 IP 定位,提出一种大规模网络别名解析算法(MLAR)。基于别名IP与非别名IP的时延、路径、Whois等的统计差异,设计过滤规则,在解析前排除大量不可能存在别名关系的 IP,提高解析的效率;将别名解析转化为分类,构建时延相似度、路径相似度等四维新颖的特征,用于过滤后可能的别名IP和非别名IP的分类。基于CAIDA百万级样本的实验表明,相比 RadarGun、MIDAR、TreeNET,正确率提高 15.8%、4.8%、5.7%,耗时最多降低 77.8%、65.3%、55.2%;在应用于 IP 定位时,SLG、LENCR、PoPG 这 3 种典型定位方法的失败率降低 65.5%、64.1%、58.1%。

关键词: 别名解析, IP定位, 网络拓扑, 网络测量, 机器学习

Abstract:

In order to accurately and efficiently perform alias resolution on interface IP and support IP geolocation,a large-scale network alias resolution algorithm (MLAR) was proposed.Based on the statistical differences in delays,paths,Whois,etc.between alias IP and non-alias IP,before resolution,filtering rules were designed to exclude a large number of IPs that can not be aliases and improve efficiency of resolution,alias resolution was transformed into classification,and four novel features such as delay similarity,path similarity,etc.were constructed for the classification of possible alias IP and non-alias IP after filtering.Experiments based on millions of samples from CAIDA show that compared with RadarGun,MIDAR,and TreeNET,the accuracy is improved by 15.8%,4.8%,5.7%,the time consumption can be reduced by up to 77.8%,65.3%,and 55.2%,when the proposed algorithm is applied to IP geolocation,the failure rates of the three typical geolocation methods such as SLG,LENCR,and PoPG are reduced by about 65.5%,64.1%,and 58.1%.

Key words: alias resolution, IP geolocation, network topology, network measurement, machine learning

中图分类号: 

No Suggested Reading articles found!