MLAR：面向IP定位的大规模网络别名解析

doi:10.11959/j.issn.2096-109x.2020044

Abstract

Abstract:

In order to accurately and efficiently perform alias resolution on interface IP and support IP geolocation,a large-scale network alias resolution algorithm (MLAR) was proposed.Based on the statistical differences in delays,paths,Whois,etc.between alias IP and non-alias IP,before resolution,filtering rules were designed to exclude a large number of IPs that can not be aliases and improve efficiency of resolution,alias resolution was transformed into classification,and four novel features such as delay similarity,path similarity,etc.were constructed for the classification of possible alias IP and non-alias IP after filtering.Experiments based on millions of samples from CAIDA show that compared with RadarGun,MIDAR,and TreeNET,the accuracy is improved by 15.8%,4.8%,5.7%,the time consumption can be reduced by up to 77.8%,65.3%,and 55.2%,when the proposed algorithm is applied to IP geolocation,the failure rates of the three typical geolocation methods such as SLG,LENCR,and PoPG are reduced by about 65.5%,64.1%,and 58.1%.

Key words: alias resolution, IP geolocation, network topology, network measurement, machine learning

CLC Number:

TP393

Fuxiang YUAN,Fenlin LIU,Chong LIU,Yan LIU,Xiangyang LUO. MLAR:large-scale network alias resolution for IP geolocation[J]. Chinese Journal of Network and Information Security, 2020, 6(4): 77-94.

Figures/Tables 17

测试序号	训练集		测试集		分类结果
测试序号	别名IP对	非别名IP对	别名IP对	非别名IP对	Acc	Ma	Fa
a₁	$\frac{1}{4} S_{0}$	$\frac{1}{4} S_{1}$	$\frac{3}{4} S_{0}$	$\frac{3}{4} S_{1}$	96.3%	2.7%	4.7%
a₂	$\frac{1}{4} S_{0}$	$\frac{1}{4} S_{1}$	$\frac{3}{4} S_{0}$	$\frac{3}{4} S_{1}$	95.4%	4.4%	4.8%
a₃	$\frac{1}{4} S_{0}$	$\frac{1}{4} S_{1}$	$\frac{3}{4} S_{0}$	$\frac{3}{4} S_{1}$	96.0%	3.8%	4.1%
b₁	$\frac{1}{2} S_{0}$	$\frac{1}{4} S_{1}$	$\frac{1}{2} S_{0}$	$\frac{1}{2} S_{1}$	96.4%	3.4%	3.7%
b₂	$\frac{1}{2} S_{0}$	$\frac{1}{4} S_{1}$	$\frac{1}{2} S_{0}$	$\frac{1}{2} S_{1}$	95.9%	4.0%	4.2%
b₃	$\frac{1}{2} S_{0}$	$\frac{1}{4} S_{1}$	$\frac{1}{2} S_{0}$	$\frac{1}{2} S_{1}$	96.8%	3.1%	3.3%
c₁	$\frac{3}{4} S_{0}$	$\frac{3}{4} S_{1}$	$\frac{1}{4} S_{0}$	$\frac{1}{4} S_{1}$	96.0%	3.8%	4.2%
c₂	$\frac{3}{4} S_{0}$	$\frac{3}{4} S_{1}$	$\frac{1}{4} S_{0}$	$\frac{1}{4} S_{1}$	96.9%	2.9%	3.2%
c₃	$\frac{3}{4} S_{0}$	$\frac{3}{4} S_{1}$	$\frac{1}{4} S_{0}$	$\frac{1}{4} S_{1}$	96.6%	3.3%	3.5%

References 34

[1]	CANBAZ M A . Internet topology mining:from big data to network science[D]. Reno:University of Nevada, 2018.
[2]	KARDES H , GUNES M H , SARAC K . Graph based induction of unresponsive routers in internet topologies[J]. Computer Networks, 2015,81: 178-200.
[3]	COSKUN I E , CANBAZ M A , GUNES M H . Efficient AS network topology measurement based on ingress to subnet reachability[C]// IEEE 41st Conference on Local Computer Networks Workshops. 2016: 87-95.
[4]	WANG Y , BURGENER D , FLORES M ,et al. Towards street-level client-independent IP geolocation[C]// Symposium on Network System Design and Implementation. 2011: 27-27.
[5]	CHEN J , LIU F , SHI Y ,et al. Towards IP location estimation using the nearest common router[J]. Journal of Internet Technology, 2018,19(7): 2097-2110.
[6]	YUAN F , LIU F , HUANG D ,et al. A high completeness PoP partition algorithm for IP geolocation[J]. IEEE Access, 2019,7: 28340-28355.
[7]	KEYS K . Internet-scale IP alias resolution techniques[J]. ACM Sigcomm Computer Communication Review, 2010,40(1): 50-55.
[8]	MARCHETTA P , PESCAPé A , . DRAGO:detecting,quantifying and locating hidden routers in traceroute IP paths[C]// Proceedings IEEE International Conference on Computer Communications. 2013: 3237-3242.
[9]	LI R , SUN Y , HU J ,et al. Street-level landmark evaluation based on nearest routers[J]. Security and Communication Networks, 2018(2): 1-12.
[10]	HINGANT J , ZAMBRANO M , PéREZ F J ,et al. HYBINT:a hybrid intelligence system for critical infrastructures protection[J]. Security and Communication Networks, 2018
[11]	方滨兴 . 从层次角度看网络空间安全技术的覆盖领域[J]. 网络与信息安全学报, 2015,1(1): 2-7.
	FANG B X . A hierarchy model on the research fields of cyberspace security technology[J]. Chinese Journal of Network and Infor-mation Security, 2015,1(1): 2-7.
[12]	赵帆, 罗向阳, 刘粉林 . 网络空间测绘技术研究[J]. 网络与信息安全学报, 2016,2(9): 1-11.
	ZHAO F , LUO X Y , LIU F L . Research on cyberspace surveying and mapping technology[J]. Chinese Journal of Network and In-formation Security, 2016,2(9): 1-11.
[13]	李欲晓, 谢永江 . 世界各国网络安全战略分析与启示[J]. 网络与信息安全学报, 2016,2(1): 1-5.
	LI Y X , XIE Y J . Analysis and enlightenment on the cybersecurity strategy of various countries in the world[J]. Chinese Journal of Network and Information Security, 2016,2(1): 1-5.
[14]	郭莉, 曹亚男, 苏马婧 ,等. 网络空间资源测绘:概念与技术[J]. 信息安全学报, 2018,3(4): 1-14.
	GUO L , CAO Y , SU M J ,et al. Cyberspace resources surveying and mapping:the concepts and technologies[J]. Journal of Cyber security, 2018,3(4): 1-14.
[15]	王松, 张野, 吴亚东 . 网络拓扑结构可视化方法研究与发展[J]. 网络与信息安全学报, 2018,4(2): 1-17.
	WANG S , ZHANG Y , WU Y D . Survey on network topology visu-alization[J]. Chinese Journal of Network and Information Security, 2018,4(2): 1-17.
[16]	GOVINDAN R , TANGMUNARUNKIT H . Heuristics for internet map discovery[C]// Proceedings IEEE International Conference on Computer Communications. 2000: 1371-1380.
[17]	KEYS K . Iffinder,a tool for mapping interfaces to routers[EB].
[18]	SPRING N , MAHAJAN R , WETHERALL D . Measuring ISP topologies with rocketfuel[J]. ACM Sigcomm Computer Communication Review, 2002,32(4): 133-145.
[19]	BENDER A , SHERWOOD R , SPRING N . Fixing ally's growing pains with velocity modeling[C]// Proceedings of the 8th ACM Sigcomm Conference on Internet Measurement. 2008: 337-342.
[20]	KEYS K , HYUN Y , LUCKIE M ,et al. Internet-scale IPv4 alias resolution with MIDAR[J]. IEEE/ACM Transactions on Networking, 2013,21(2): 383-399.
[21]	SHERWOOD R , SPRING N . Touring the internet in a TCP sidecar[C]// Proceedings of the 6th ACM Sigcomm Conference on Internet Measurement. 2006: 339-344.
[22]	SHERRY J , KATZ-BASSETT E , PIMENOVA M ,et al. Resolving IP aliases with prespecified timestamps[C]// Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement. 2010: 172-178.
[23]	MARCHETTA P , PERSICO V , PESCAPè A . Pythia:yet another active probing technique for alias resolution[C]// Proceedings of the 9th ACM Conference on Emerging Networking Experiments and Technologies. 2013: 229-234.
[24]	GRAILET J F , DONNET B . Towards a renewed alias resolution with space search reduction and IP fingerprinting[C]// Network Traffic Measurement and Analysis Conference. 2017: 1-9.
[25]	GUNES M H , SARAC K . Analytical IP alias resolution[C]// IEEE International Conference on Communications. 2006: 459-464.
[26]	AUGUSTIN B , CUVELLIER X , ORGOGOZO B ,et al. Avoiding traceroute anomalies with paris traceroute[C]// Proceedings of the 6th ACM SIGCOMM Conference on Internet Measurement. 2006: 153-158.
[27]	SPRING N , DONTCHEVA M , RODRIG M ,et al. How to resolve IP aliases[D]. Seattle:University of Washington, 2004.
[28]	赵洪华, 白华利, 陈鸣 ,等. 别名解析中的别名过滤技术[J]. 软件学报, 2009 (8): 2280-2288.
	ZHAO H , BAI H L , CHEN M ,et al. Alias filtering technique in alias resolution[J]. Journal of Software, 2009 (8): 2280-2288.
[29]	TOZAL M , SARAC K . TraceNET:an internet topology data collector[C]// Proceedings of the 10th ACM SIGCOMM Conference on Internet Measurement. 2010: 356-368.
[30]	PADMANABHAN V N , SUBRAMANIAN L . An investigation of geographic mapping techniques for internet hosts[J]. ACM SIGCOMM Computer Communication Review, 2001,31(4): 173-185.
[31]	GUEYE B , ZIVIANI A , CROVELLA M ,et al. Constraint-based geolocation of internet hosts[J]. IEEE/ACM Transactions on Networking, 2006,14(6): 1219-1232.
[32]	SCHAPIRA M , ZHU Y , REXFORD J . Putting BGP on the right path:a case for next-hop routing[C]// Proceedings of the 9th ACM SIGCOMM Workshop on Hot Topics in Networks. 2010:3.
[33]	LENCSE G , RéPáS S , . Performance analysis and comparison of different DNS64 implementations for linux,openBSD and freeBSD[C]// IEEE 27th International Conference on Advanced Information Networking and Applications. 2013: 877-884.
[34]	ZHAO F , LUO X , GAN Y ,et al. IP geolocation based on identification routers and local delay distribution similarity[J]. Concurrency and Computation:Practice and Experience, 2018: 1-15.

Metrics

Recommended 0

No Suggested Reading articles found!

IP对	类别	比例	方向：路径中不同路由IP的数量			长度：探测路径的跳数差异
IP对	类别	比例	≤1	2	≥3	≤1	2	≥3
	A	98.1%	95.2%	2.9%	0	96.4%	1.7%	0
别名IP对	B	1.9%	1.4%	0.5%	0	0	0	1.9%
	C	0	0	0	0	0	0	0
	D	0	0	0	0	0	0	0
	A	0.4%	0.1%	0.3%	0	0.2%	0.2%	0
非别名IP对	B	13.1%	4.3%	8.8%	0	0	0	13.1%
	C	34.4%	0	0	34.4%	10.9%	23.5%	0
	D	52.1%	0	0	52.1%	0	0	52.1%

相同Whois信息项的条数	别名IP比例	非别名IP比例
≤4	0.2%	93.9%
5~10	0.5%	3.7%
11~15	0.9%	1.6%
≥15	98.4%	0.8%

特征序号	特征名称
F₁	时延相似度S_d
F₂	路径相似度S_p
F₃	Whois信息相似度S_w
F₄	主机信息相似度S_h

样本来源	样本分布	样本数量			探测源分布
样本来源	样本分布	接口IP	别名IP对	非别名IP对	探测源分布
CAIDA	中国	9.153×10⁶	5.729×10⁷	7.113×10⁹	郑州、北京、上海、广州、杭州、天津、成都、西安、济南、武汉
	美国	1.075×10⁷	8.211×10⁷	3.025×10¹¹	纽约、芝加哥、亚特兰大、华盛顿、迈阿密、西雅图、洛杉矶、达拉斯、旧金山、菲尼克斯

过滤规则	通过各规则，不同地区被过滤掉的两类样本比例
	别名IP				非别名IP
	北京	上海	纽约	迈阿密	北京	上海	纽约	迈阿密
1)	0	0	0	0	22.2%	18.9%	24.5%	26.3%
2)	0	0	0	0	5.3%	3.6%	7.1%	5.0%
3)	0	0.0041%	0	0	26.6%	30.6%	26.9%	28.9%
4)	0	0	0	0.0023%	20.4%	21.1%	22.6%	23.3%
5)	0	0	0	0	8.9%	7.5%	3.5%	2.7%
合计	0	0.0041%	0	0.0023%	83.4%	81.7%	84.6%	86.2%

MLAR:large-scale network alias resolution for IP geolocation

RichHTML

PDF下载

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 17

References 34

Related Articles 15

Metrics

Recommended 0

测试序号	特征组合		分类效果
测试序号	特征组合	Acc	Ma	Fa
1	F₁	81.1%	18.7%	19.0%
2	F₂	84.9%	14.9%	15.2%
3	F₃	82.4%	17.5%	17.8%
4	F₄	85.3%	14.3%	15.0%
5	F₁、F₂	89.1%	10.0%	11.7%
6	F₁、F₃	88.6%	10.9%	11.8%
7	F₁、F₄	90.5%	9.0%	10.0%
8	F₂、F₃	87.7%	12.0%	12.5%
9	F₂、F₄	92.3%	7.7%	7.8%
10	F₃、F₄	91.5%	7.8%	9.1%
11	F₁、F₂、F₃	93.9%	6.0%	6.2%
12	F₁、F₂、F₄	94.4%	5.1%	6.1%
13	F₁、F₃、F₄	94.3%	5.3%	6.0%
14	F₂、F₃、F₄	95.2%	4.5%	5.2%
15	F₁、F₂、F₃、F₄	96.2%	3.6%	4.0%

数据集来源	测试序号	分类模型		分类效果
数据集来源	测试序号	分类模型	Acc	Ma	Fa
	1	SVM	96.5%	3.3%	3.6%
	2		96.2%	3.7%	4.0%
	3		96.4%	3.4%	3.7%
	4	LR	96.0%	3.8%	4.2%
CAIDA	5		95.3%	4.7%	4.6%
	6		95.7%	4.2%	4.4%
	7	NBC	95.5%	4.3%	4.6%
	8		94.9%	5.0%	5.3%
	9		96.0%	3.8%	4.1%
	10	SVM	97.1%	2.6%	3.3%
	11		97.5%	2.3%	2.8%
	12		97.1%	2.8%	3.0%
	13	LR	96.8%	3.2%	3.2%
ISP	14		96.9%	2.8%	3.4%
	15		96.6%	3.5%	3.4%
	16	NBC	97.2%	2.6%	2.9%
	17		97.3%	2.4%	3.1%
	18		96.7%	3.0%	3.6%

测试序号	RadarGun			MIDAR			TreeNET			MLAR
测试序号	Acc	Ma	Fa	Acc	Ma	Fa	Acc	Ma	Fa	Acc	Ma	Fa
1	84.9%	17.2%	13.0%	92.5%	7.4%	7.5%	90.6%	9.9%	9.0%	96.7%	2.9%	3.7%
2	80.4%	18.8%	20.4%	91.6%	8.5%	8.3%	89.7%	9.9%	10.7%	95.3%	4.3%	5.1%
3	76.6%	23.9%	22.8%	90.2%	9.8%	9.8%	90.1%	10.1%	9.8%	96.1%	3.5%	4.3%
4	84.1%	15.2%	16.6%	89.8%	9.9%	10.6%	91.3%	8.6%	8.8%	95.6%	4.8%	3.9%
5	87.5%	13.4%	11.5%	93.1%	7.2%	6.6%	91.2%	8.0%	9.6%	95.2%	4.6%	5.0%

方法	随着接口IP数量递增，不同方法3次测试所用时长/h
	1×10⁶			2×10⁶			3×10⁶			4×10⁶			5×10⁶
	1	2	3	1	2	3	1	2	3	1	2	3	1	2	3
RadarGun	10.4	10.2	11.7	22.1	18.9	18.6	30.1	33.5	30.0	46.9	46.0	49.3	65.7	64.9	68.7
MIDAR	7.0	8.8	6.8	13.2	15.1	13.5	20.1	23.5	20.9	27.5	26.8	30.8	41.1	44.3	38.9
TreeNET	4.8	5.2	6.5	9.9	10.6	11.1	14.4	15.2	17.3	23.0	22.4	24.9	31.9	32.8	34.1
MLAR	3.5	3.3	3.6	5.4	5.1	4.6	8.1	7.4	6.9	11.5	9.8	10.2	15.5	16.7	14.9

别名解析方法	在使用不同别名解析方法前后，不同定位算法对两个区域的目标IP的定位失败率
	北京（中国）			加利福尼亚州（美国）
	SLG^[4]	LENCR ^[5]	PoPG^[6]	SLG^[4]	LENCR^[5]	PoPG^[6]
无	28.9%	31.6%	18.7%	25.1%	26.5%	15.2%
RadarGun	21.6%	24.4%	13.2%	19.3%	16.4%	11.9%
MIDAR	13.5%	16.3%	9.6%	15.9%	13.7%	9.7%
TreeNET	16.1%	19.2%	11.8%	16.2%	14.6%	10.4%
MLAR	9.0%	10.4%	6.7%	9.5%	10.3%	7.3%

[1]	Ruiqi XIA, Manman LI, Shaozhen CHEN. Identification on the structures of block ciphers using machine learning [J]. Chinese Journal of Network and Information Security, 2023, 9(3): 79-89.
[2]	Fan SHI, Yao ZHONG, Pengfei XUE, Chengxi XU. Dual-stack host discovery method based on SSDP and DNS-SD protocol [J]. Chinese Journal of Network and Information Security, 2023, 9(1): 56-66.
[3]	Nan WEI, Lihua YIN, Hong NING, Binxing FANG. Preliminary study on the reform of machine learning teaching [J]. Chinese Journal of Network and Information Security, 2022, 8(4): 182-189.
[4]	Cheng HUANG, Mingxu SUN, Renyu DUAN, Susheng WU, Bin CHEN. Vulnerability identification technology research based on project version difference [J]. Chinese Journal of Network and Information Security, 2022, 8(1): 52-62.
[5]	Yingjun ZHANG,Ushangqi LI,Mu YANG,Haixia ZHANG,Kezhen HUANG. Survey on anomaly detection technology based on logs [J]. Chinese Journal of Network and Information Security, 2020, 6(6): 1-12.
[6]	Xi FU,Hui LI,Xingwen ZHAO. Survey on phishing detection research [J]. Chinese Journal of Network and Information Security, 2020, 6(5): 1-10.
[7]	Kang HE,Yuefei ZHU,Long LIU,Bin LU,Bin LIU. Improve the robustness of algorithm under adversarial environment by moving target defense [J]. Chinese Journal of Network and Information Security, 2020, 6(4): 67-76.
[8]	Ziming LUO,Shubin XU,Xiaodong LIU. Scheme for identifying malware traffic with TLS data based on machine learning [J]. Chinese Journal of Network and Information Security, 2020, 6(1): 77-83.
[9]	Wei HUANG,Cuncai LIU,Sibo QI. LSTM network traffic prediction and link congestion warning scheme for single port and single link [J]. Chinese Journal of Network and Information Security, 2019, 5(6): 50-57.
[10]	Lei SONG, Chunguang MA, Guanghan DUAN. Machine learning security and privacy:a survey [J]. Chinese Journal of Network and Information Security, 2018, 4(8): 1-11.
[11]	Tuosiyu MING, Hongchang CHEN. Research progress and trend of text summarization [J]. Chinese Journal of Network and Information Security, 2018, 4(6): 1-10.
[12]	Zheng-qi WANG,Xiao-bing FENG,Chi ZHANG. Study of high-speed malicious Web page detection system based on two-step classifier [J]. Chinese Journal of Network and Information Security, 2017, 3(8): 44-60.
[13]	Xi ZHANG,Zhi-wei YAN,Hong-tao LI,Guang-gang GENG. Research of phishing detection technology [J]. Chinese Journal of Network and Information Security, 2017, 3(7): 7-24.
[14]	Dong ZHANG,Yao ZHANG,Gang LIU,Gui-xiang SONG. Research on host malcode detection using machine learning [J]. Chinese Journal of Network and Information Security, 2017, 3(7): 25-32.
[15]	Bo-wen SUN,Yan-yi HUANG,Qiao-kun WEN,Bin TIAN,Peng WU,Qi LI. Malware classification method based on static multiple-feature fusion [J]. Chinese Journal of Network and Information Security, 2017, 3(11): 68-76.