GDD-Geo: IPv6 geolocation by graph dual decomposition

Abstract

IP geolocation is a technique used to infer the location of an IP address through its network measurement features. It is widely used in network security, network management, and location-based services. To improve geolocation accuracy in IPv6 networks, especially when landmarks are sparse, we propose an IPv6 geolocation method based on graph dual decomposition called GDD-Geo. GDD-Geo models an IPv6 address by its network measurement attributes, including paths, delay values, and addresses. The geolocation process involves comparing the similarity of these attributes. GDD-Geo comprises two sub-algorithms, GDD-CGeo and GDD-SGeo, which provide city-level and street-level (oriented) geolocation results, respectively. Particularly, we design two graph decomposition algorithms to transform the paths represented by router interfaces into the paths represented by subgraphs based on the characteristics of IPv6 address distribution and delay distribution. The former decomposition is the support for GDD-CGeo, while the latter decomposition is conducted on the results of the former decomposition and supports GDD-SGeo. Due to the aggregation and reconstruction effects of paths derived from graph decomposition, GDD-Geo can reduce the dependence on landmarks and thus can cope with the landmark-sparse scenarios. Experimental results of city-level geolocation show that GDD-CGeo can accurately geolocate the IPv6 targets at the city level. Street-level (oriented) geolocation results in six cities within different countries show that the median errors of GDD-SGeo are 1.66–5.27 km, and the mean errors are 2.55–5.88 km. Compared with popular algorithms SLG and MLP-Geo, GDD-SGeo performs significantly better on sparse landmark datasets, with at least a 60% decrease in errors.