Chinese Journal of Network and Information Security ›› 2020, Vol. 6 ›› Issue (4): 77-94.doi: 10.11959/j.issn.2096-109x.2020044

• Papers • Previous Articles     Next Articles

MLAR:large-scale network alias resolution for IP geolocation

Fuxiang YUAN1,2(),Fenlin LIU1,2,Chong LIU1,2,Yan LIU1,2,Xiangyang LUO1,2   

  1. 1 School of Cyberspace Security,Information Engineering University,Zhengzhou 450001,China
    2 State Key Laboratory of Mathematical Engineering and Advanced Computing,Zhengzhou 450001,China
  • Revised:2020-03-19 Online:2020-08-15 Published:2020-08-13
  • Supported by:
    The National Natural Science Foundation of China(U1636219);The National Natural Science Foundation of China(U1736214);The National Natural Science Foundation of China(U1804263);The National Key R&D Program of China(2016YFB0801303);The National Key R&D Program of China(2016QY01W0105);The Plan for Scientific Innovation Talent of Henan Province(184200510018)


In order to accurately and efficiently perform alias resolution on interface IP and support IP geolocation,a large-scale network alias resolution algorithm (MLAR) was proposed.Based on the statistical differences in delays,paths,Whois,etc.between alias IP and non-alias IP,before resolution,filtering rules were designed to exclude a large number of IPs that can not be aliases and improve efficiency of resolution,alias resolution was transformed into classification,and four novel features such as delay similarity,path similarity,etc.were constructed for the classification of possible alias IP and non-alias IP after filtering.Experiments based on millions of samples from CAIDA show that compared with RadarGun,MIDAR,and TreeNET,the accuracy is improved by 15.8%,4.8%,5.7%,the time consumption can be reduced by up to 77.8%,65.3%,and 55.2%,when the proposed algorithm is applied to IP geolocation,the failure rates of the three typical geolocation methods such as SLG,LENCR,and PoPG are reduced by about 65.5%,64.1%,and 58.1%.

Key words: alias resolution, IP geolocation, network topology, network measurement, machine learning

CLC Number: 

No Suggested Reading articles found!