CN106998371B

CN106998371B - Credible IP information judging method, IP information base updating method and device

Info

Publication number: CN106998371B
Application number: CN201610048749.2A
Authority: CN
Inventors: 章文
Original assignee: Advanced New Technologies Co Ltd
Current assignee: Advanced New Technologies Co Ltd; Advantageous New Technologies Co Ltd
Priority date: 2016-01-25
Filing date: 2016-01-25
Publication date: 2020-11-06
Anticipated expiration: 2036-01-25
Also published as: CN106998371A

Abstract

The embodiment of the application discloses a method for judging credible IP information, a method and a device for updating an IP information base, and aims to solve the problem that whether collected IP address information and geographic position information corresponding to the collected IP address information are credible cannot be judged in the prior art. The method for judging the credible IP information comprises the following steps: acquiring IP address information of network equipment and geographical position information corresponding to the IP address information to form a first information set; determining a preset geographical area where geographical position information corresponding to the IP address information to be judged is located; determining the number of the IP address information which is the same as the value of the IP address information to be judged in a preset IP address field and is in the preset geographic area in the first information set; judging whether the number is greater than or equal to a preset number threshold value; and if so, judging that the IP address information to be judged is credible IP geographical position information.

Description

Credible IP information judging method, IP information base updating method and device

Technical Field

The present application relates to computer technologies, and in particular, to a method for determining trusted IP information, and a method and an apparatus for updating an IP information base.

Background

The IP Address (Internet Protocol Address) is a logical Address allocated to each network device in the Internet, each network device in the Internet corresponds to a geographical location information (e.g., latitude and longitude information), and an IP geographical information base including the mapped IP Address information and geographical location information can be formed by collecting the IP Address information of each network device in the Internet and the geographical location information corresponding to the IP Address information. The IP geographic information base can be applied to various scenarios, such as: and determining the geographical position of the network equipment according to the IP address of the network equipment.

Generally, the collected IP address information in the internet and the geographic location information corresponding to the IP address information are not all correct. For example: the acquired IP address information of the device a is: 192.201.30.45, and the IP address information: 192.201.30.45 are: a supermarket b in beijing, and in practical cases, the information of the IP address: 192.201.30.45 the corresponding geographical location information should be: a supermarket c in beijing, so that the data is not trusted.

On the one hand, in the prior art, after the IP address information in the internet and the geographic location information corresponding to the IP address information are collected, no technology exists for determining whether the collected IP address information and the geographic location information corresponding to the collected IP address information are authentic.

On the other hand, in the prior art, since the IP addresses allocated to the network devices in the internet and the geographical location information corresponding to the IP addresses are constantly changed, after the IP geographical information base is formed, the IP address information in the internet and the geographical location information corresponding to the IP address information can be collected in time, and the IP geographical information base is updated by using the collected information, so as to ensure the data accuracy. Obviously, in the prior art, if it cannot be determined whether the collected IP address information and the geographic location information corresponding to the collected IP address information are authentic, the accuracy of the data in the updated IP geographic information base cannot be ensured.

Disclosure of Invention

An embodiment of the present application provides a method for determining trusted IP information, a method and an apparatus for updating an IP information base, so as to solve one of the above problems in the prior art.

In order to solve the above technical problem, embodiments of the present application provide a method for determining trusted IP information, a method and an apparatus for updating an IP information base. The method is realized by the following steps:

a method for judging credible IP information comprises the following steps:

acquiring IP address information of network equipment and geographical position information corresponding to the IP address information to form a first information set;

determining a preset geographical area where geographical position information corresponding to the IP address information to be judged is located;

determining the number of the IP address information which is the same as the value of the IP address information to be judged in a preset IP address field and is in the preset geographic area in the first information set;

judging whether the number is greater than or equal to a preset number threshold value;

and if so, judging that the geographic position information corresponding to the IP address information to be judged is the credible geographic position information of the IP address information.

A method for judging credible IP information comprises the following steps:

respectively determining the number of IP address information which is positioned in each preset geographic area and has the same value as the IP address information to be judged in a preset IP address field in the first information set; the second information set comprises a plurality of pieces of IP address information and geographic position information corresponding to each piece of IP address information;

judging whether the number corresponding to the determined preset geographic area is greater than the number corresponding to other preset geographic areas;

An updating method of an IP information base comprises the following steps:

acquiring IP address information of network equipment and geographical position information corresponding to the IP address information to obtain a first information set containing the acquired IP address information and geographical position information;

if the IP address information contained in the first information set exists in a second information set to be updated, judging whether the geographic position information corresponding to the IP address information in the first information set is consistent with the geographic position information corresponding to the IP address information in the second information set;

if the IP address information is inconsistent with the preset IP address field value, determining a preset geographical area where the geographical position information corresponding to the IP address information in the first information set is located, and counting the number of the IP address information in the first information set, wherein the IP address information is the same as the IP address information in the preset IP address field value;

and if the number is greater than or equal to a preset number threshold, replacing the geographic position information corresponding to the IP address information in the second information set with the geographic position information corresponding to the IP address information in the first information set.

An updating method of an IP information base comprises the following steps:

grouping the first information sets according to preset geographical areas where the geographical position information is located to obtain grouped sets corresponding to the preset geographical areas;

if the IP address information is inconsistent with the preset geographic area, determining the preset geographic area where the geographic position information corresponding to the IP address information in the first information set is located, and determining a packet set corresponding to the preset geographic area;

judging whether the number of the IP address information with the same value of the IP address information in a preset IP address field in the determined packet set exceeds the number of the IP address information with the same value of the IP address information in the preset IP address field in the rest packet sets;

and if so, replacing the geographical position information corresponding to the IP address information in the second information set with the geographical position information corresponding to the IP address information in the first information set.

An apparatus for determining trusted IP information, comprising:

the system comprises an acquisition unit, a processing unit and a processing unit, wherein the acquisition unit is used for acquiring IP address information of network equipment and geographical position information corresponding to the IP address information to form a first information set;

the first determining unit is used for determining a preset geographical area where geographical position information corresponding to the IP address information to be judged is located;

a second determining unit, configured to determine, in the first information set, the number of pieces of IP address information that are the same as the value of the to-be-determined IP address information in a preset IP address field and are in the preset geographic area;

the first judging unit is used for judging whether the number is greater than or equal to a preset number threshold value or not;

and the judging unit is used for judging that the geographic position information corresponding to the IP address information to be judged is the credible geographic position information of the IP address information when the number is greater than or equal to a preset number threshold.

An apparatus for determining trusted IP information, comprising:

a first determining unit, configured to determine, in the first information set, the number of pieces of IP address information that are located in each preset geographic area and that are the same as values of the pieces of IP address information to be determined in a preset IP address field, respectively;

the second determining unit is used for determining a preset geographic area where the geographic position information corresponding to the IP address information to be judged is located;

a first judging unit, configured to judge whether the number corresponding to the determined preset geographic area is greater than the number corresponding to another preset geographic area;

and the judging unit is used for judging that the geographic position information corresponding to the IP address information to be judged is the credible geographic position information of the IP address information when the number corresponding to the determined preset geographic area is larger than the number corresponding to other preset geographic areas.

An updating device of an IP information base comprises:

the system comprises a collecting unit, a processing unit and a processing unit, wherein the collecting unit is used for collecting IP address information of network equipment and geographical position information corresponding to the IP address information to obtain a first information set containing the collected IP address information and the geographical position information;

a first determining unit, configured to determine whether geographic location information corresponding to the IP address information in the first information set is consistent with geographic location information corresponding to the IP address information in the second information set when the IP address information included in the first information set exists in the second information set to be updated;

a first determining unit, configured to determine, when geographic location information corresponding to the IP address information in the first information set is inconsistent with geographic location information corresponding to the IP address information in the second information set, a preset geographic area where the geographic location information corresponding to the IP address information in the first information set is located, and count the number of IP address information in the first information set that is the same as a value of the IP address information in a preset IP address field;

a second judging unit, configured to judge whether the number is greater than or equal to a preset number threshold;

and the replacing unit is used for replacing the geographical position information corresponding to the IP address information in the second information set with the geographical position information corresponding to the IP address information in the first information set when the number is greater than or equal to a preset number threshold.

An updating device of an IP information base comprises:

the grouping unit is used for grouping the first information set according to the preset geographical area where the geographical position information is located to obtain a grouping set corresponding to each preset geographical area;

a first determining unit, configured to determine, when geographic location information corresponding to the IP address information in the first information set is inconsistent with geographic location information corresponding to the IP address information in the second information set, a preset geographic area in which the geographic location information corresponding to the IP address information in the first information set is located, and determine a packet set corresponding to the preset geographic area;

a second judging unit, configured to judge whether the number of pieces of IP address information in the determined packet set, which is the same as the value of the IP address information in the preset IP address field, exceeds the number of pieces of IP address information in the remaining packet sets, which is the same as the value of the IP address information in the preset IP address field;

According to the technical scheme provided by the embodiments of the application, after the IP address information and the geographic position information of the network equipment are collected, whether the IP address information and the geographic position information are credible needs to be measured. Research shows that for some collected IP address information and corresponding geographical location information, if the number of IP address information existing in a preset geographical area corresponding to the geographical location information and having the same value as the IP address information to be determined in a preset IP address field is larger, the higher the reliability of the IP address information and the corresponding geographical location information is. Based on the principle, the embodiment of the application determines the number of the IP address information in the preset geographic area and the value of the IP address information to be determined in the preset IP address field, and determines whether the geographic position information corresponding to the IP address information to be determined is the credible geographic position information of the IP address information according to the number.

In addition, in the process of updating the pre-generated second information set by using the collected IP address information and the geographic position information corresponding to the collected IP address information, whether certain IP address information and the geographic position information corresponding to the certain IP address information are credible can be determined according to the principle, and if the certain IP address information and the geographic position information corresponding to the certain IP address information are credible, the geographic position information corresponding to the certain IP address information in the second information set is replaced by the geographic position information corresponding to the certain IP address information in the first information set, so that the updating of the second information set is completed, and the accuracy of data in the second information set to be updated is ensured.

Drawings

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments or the prior art will be briefly introduced below, it is obvious that the drawings in the following description are only some embodiments described in the present application, and for those skilled in the art, other drawings can be obtained according to the drawings without any creative effort.

Fig. 1 is a flowchart of a method for determining trusted IP geographic location information according to an embodiment of the present application;

fig. 2 shows a process of determining whether certain IP address information and geographical location information corresponding to the certain IP address information are authentic in an embodiment of the present application;

fig. 3 is a flowchart of a method for determining trusted IP geolocation information according to another embodiment of the present application;

fig. 4 is a flowchart of an update method of an IP information base according to an embodiment of the present application;

fig. 5 illustrates a process of updating a second information set by using a first information set acquired in the embodiment of the present application;

fig. 6 is a flowchart of an update method of an IP information base according to another embodiment of the present application;

fig. 7 is a flowchart of an update method of an IP information base provided on the basis of the embodiment shown in fig. 6;

fig. 8 is a block diagram of an apparatus for determining trusted IP information according to an embodiment of the present application;

fig. 9 is a block diagram of an apparatus for updating an IP information base according to an embodiment of the present application;

fig. 10 is a block diagram of an apparatus for updating an IP information base according to another embodiment of the present application.

Detailed Description

In order to make those skilled in the art better understand the technical solutions in the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.

Fig. 1 is a flowchart of a method for determining trusted IP geographic location information according to an embodiment of the present application, and with reference to fig. 1 and fig. 2, the method includes the following steps:

s101: the method comprises the steps of collecting IP address information of network equipment and geographical position information corresponding to the IP address information to form a first information set.

The present embodiment may obtain the first information set 20 including the collected IP address information and geographic location information by collecting the IP address information and geographic location information of the network device in the internet periodically or aperiodically. The network device may include various devices that can be connected to an internet environment and are assigned a unique IP address, such as a Personal Computer (PC), a mobile phone, a printer, and a server. The geographical location information may be represented in the form of longitude and latitude, or geographical name. The above-mentioned collection work can be completed by a preset information collection platform, and the information collection platform has conditions for collecting information, storing information and calculating a large amount of data. The Internet Protocol corresponding to the IP address may include IPV4(Internet Protocol Version 4, Version 4 of the Internet Protocol) and IPV6(Internet Protocol Version 6, Version 6 of the Internet Protocol).

S102: and determining a preset geographical area where the geographical position information corresponding to the IP address information to be judged is located.

In this embodiment, it may be determined whether any IP address in the first information set 20 and the corresponding geographic location information are trusted. As shown in fig. 2, for example: at the IP address to be determined whether the IP address is authentic: 189.234.102.109, the IP address is displayed in the data 210: 189.234.102.109 are: a certain department of Beijing a (which can be expressed in longitude and latitude). In order to determine the reliability of the IP address information and the geographic location information corresponding to the IP address information, the geographic location may be divided into a plurality of preset geographic areas according to a certain distance range, for example, each of the divided preset geographic areas is a rectangular area with a side length of 10 km, or a circular area with a square circle of 10 km, or the like. Thus, for any one piece of geographical location information, a corresponding preset geographical area can be determined. As shown in fig. 2, by searching, the information related to the geographical position can be determined: a preset geographical area R corresponding to a certain market a in Beijing.

S103: in the first information set 20, the number of IP address information that is the same as the value of the IP address information to be determined in the preset IP address field and is in the preset geographical area is determined.

In this embodiment, if the values of one IP address information and the other IP address information in the preset IP address field are the same, it may be defined that the two IP address information are similar to each other. For the IP address of IPV4, it is expressed in decimal numbers or corresponding 32-bit binary numbers, for example: decimal IP address: 100.4.5.6, the corresponding 32-bit binary IP address is: 01100100.00000100.00000101.00000110 (in 4 segments, 8 bits each). Wherein, for the IP address of IPV4, if the IP address is expressed in decimal number, the preset IP address field may be the first 3 fields divided by ".": 100.4.5, if the predetermined IP address field is represented by 32-bit binary number, the predetermined IP address field can be the first 24 bits (first 3 segments, 8 bits per segment): 01100100.00000100.00000101. similarly, if the IP address of IPV6 is expressed as a decimal number or a 128-bit binary number, the predetermined IP address field needs to be adjusted accordingly. In short, for different types of IP addresses, the corresponding predetermined IP address field may be adjusted accordingly.

In this embodiment, based on the data included in the first information set 20, the data in the preset geographic area R and the IP address information: 189.234.102.109 the number M of IP address information having the same value in the preset IP address field. Continuing with the above example, for the IP address information to be determined whether authentic or not: 189.234.102.109, similar IP address information may be 189.234.102.x, where x may be any number from 0 to 255, for which: 189.234.102. x. if the geographic location information corresponding thereto in the first set of information 20 is: if the "peking mall b" is located in the preset geographic area R, the IP address information may be determined as follows: 189.234.102.x with the above IP address information: 189.234.102.109 are identical in value in the preset IP address field and are in the same preset geographical area. Through the above process, the total number of the above 189.234.102.x finally determined can be determined as the above M.

S104: judging whether the number M is greater than or equal to a preset number threshold value M₀(ii) a If yes, the process proceeds to step S105.

S105: and judging that the geographic position information corresponding to the IP address information to be judged is the credible geographic position information of the IP address information.

For example, assume a predetermined number threshold M is set₀Is 10 (may be an empirical value), if the obtained number M ≧ 10 indicates that the IP address information in the first information set 20: 189.234.102.109 corresponding to geographical location information: "Peking certain mall a" is trusted (or trusted with a high degree of confidence).

Based on the above embodiments, after the IP address information and the geographic location information of the network device are collected, it is necessary to measure whether the IP address information and the geographic location information are trusted. Research shows that for some collected IP address information and corresponding geographical location information, if the number of IP address information existing in a preset geographical area corresponding to the geographical location information and having the same value as the IP address information to be determined in a preset IP address field is larger, the higher the reliability of the IP address information and the corresponding geographical location information is. Based on the principle, the embodiment of the application realizes the verification of the reliability of the IP position information by determining the number of the IP address information in the preset geographic area and the value of the IP address information to be judged in the preset IP address field, and judging whether the geographic position information corresponding to the IP address information to be judged is the credible geographic position information of the IP address information according to the number.

Fig. 3 is a flowchart of a method for determining trusted IP geographic location information according to another embodiment of the present application, and with reference to fig. 3 and fig. 2, the method includes the following steps:

s201: the method comprises the steps of collecting IP address information of network equipment and geographical position information corresponding to the IP address information to form a first information set. The step can refer to the content of the step S101, and is not described again.

S202: in the first information set, the number of the IP address information which is located in each preset geographic area and is the same as the value of the IP address information to be judged in the preset IP address field is respectively determined.

As mentioned above, for other IP address information having the same value in the preset IP address field as the IP address information to be determined, the other IP address information may be distributed in one or more preset geographical areas. If the IP address information is in the preset IP address fields, the number of the IP address information in each preset geographic area is counted. For example: the preset geographical area where the distribution situation exists comprises: the number of the preset geographic areas R, the number of the preset geographic areas S and the number of the preset geographic areas H distributed in the preset geographic areas R are 20, the number of the preset geographic areas S distributed in the preset geographic areas S are 3 and the number of the preset geographic areas H distributed in the preset geographic areas H is 1.

S203: and determining a preset geographical area where the geographical position information corresponding to the IP address information to be judged is located.

In the example of fig. 2, with the IP address information: 189.234.102.109 corresponding to geographical location information: the preset geographical area of a certain Beijing mall is as follows: a geographical area R is preset.

S204: judging whether the number corresponding to the determined preset geographic area is greater than the number corresponding to other preset geographic areas; if yes, the process proceeds to step S205.

In the above example, the numbers M are ordered from large to small: the preset geographic area R is larger than the preset geographic area S and larger than the preset geographic area H. That is, the number of similar IP address information distributed within the preset geographical area R is the largest, indicating that the IP address information to be determined: 189.234.102.109, the corresponding geographical location information: the credibility of a certain market a in Beijing is the highest.

S205: and judging that the geographic position information corresponding to the IP address information to be judged is the credible geographic position information of the IP address information.

Similarly, the embodiment of the application realizes the verification of the reliability of the IP location information by determining the number of the IP address information in the preset geographic area and the same value of the IP address information to be determined in the preset IP address field, and determining whether the geographic location information corresponding to the IP address information to be determined is the credible geographic location information of the IP address information according to the number.

The above method for determining whether the collected IP address information and the geographical location information corresponding to the collected IP address information are authentic may be used in a method for updating data in a pre-generated IP information base to ensure the accuracy of the data in the IP information base, and the method for updating the IP information base will be described next.

Fig. 4 is a flowchart of a method for updating an IP information base according to an embodiment of the present application, and with reference to fig. 4 and fig. 5, the method includes the following steps:

s301: the method comprises the steps of collecting IP address information of network equipment in the Internet and geographic position information corresponding to the IP address information to obtain a first information set 20 containing the collected IP address information and the collected geographic position information.

As shown in fig. 5, after the second information set (also referred to as an IP geographic information base) 10 is established, the present embodiment may acquire IP address information and geographic location information of each network device in the internet periodically or aperiodically to obtain a first information set 20 including the acquired IP address information and geographic location information, and finally update the established second information set 10 by using the first information set 20, thereby ensuring the accuracy of the data in the second information set 10. For a large amount of collected IP address information and corresponding geographic location information, data that does not meet the requirements may be filtered in advance, for example, data with irregular IP addresses and geographic location information are filtered, and then a large amount of filtered data is put into the first information set 20. It should be noted that, according to actual requirements, the acquisition platform may also acquire other information such as a Media/Media Access Control (MAC) address of each network device in the internet.

S303: if some IP address information included in the first information set 20 exists in the second information set 10 to be updated, it is determined whether the geographic location information corresponding to the IP address information in the first information set 20 is consistent with the geographic location information corresponding to the IP address information in the second information set 10. If not, the process proceeds to step S304.

Through the step S303, the data in the first information set 20 is compared with the data in the second information set 10, and if the geographic location information corresponding to the same IP address in the first information set 20 and the second information set 10 is found to be inconsistent, it indicates that the geographic location information corresponding to the IP address information is in dispute, which means that the geographic location information originally stored in the second information set 10 may be inaccurate or changed at the current time. For example: in the first set of information 20 together with the IP address: 189.234.102.109, the IP address is displayed in the data 210: 189.234.102.109 are: a certain Beijing mall a (which can be expressed in longitude and latitude); and in the second set of information 10: 189.234.102.109, the IP address is displayed in the data 110 corresponding to the IP address: 189.234.102.109 are: beijing supermarket b. Obviously, at this time, for the same IP address information, the corresponding geographic location information is disputed, and it is necessary to further verify which geographic location information has higher reliability.

S304: determining a preset geographical area where the geographical location information corresponding to the IP address information in the first information set 20 is located, and counting the number of IP address information in the preset geographical area in the first information set 20 and having the same value as the IP address information in the preset IP address field.

The definition of similar IP addresses (same value in the default IP address field) can be referred to above. Generally, if the number of other IP addresses having the same value as that of a certain IP address in the preset IP address field is larger in the preset geographic area, the higher the confidence level of the geographic location information corresponding to the IP address is.

Following the above example, in the first set of information 20: 189.234.102.109, the IP address is displayed in the data 210: 189.234.102.109 are: the preset geographic area corresponding to the certain Beijing mall a can be determined by searching the certain Beijing mall a, for example, as follows: and a square circle with the east longitude 20 degrees and the north latitude 30 degrees as the center is 10 kilometers. It is assumed that obtaining the IP address information in the first information set 20 in the above-mentioned predetermined geographic area (10 km of a square circle with "20 east longitude", 30 north latitude "as the center) and having the same value as the IP address information in the predetermined IP address field by searching includes:

IP address: 189.234.102.101, corresponding geographical location information: a certain Beijing mall a;

IP address: 189.234.102.102, corresponding geographical location information: a certain Beijing mall a;

IP address: 189.234.102.104, corresponding geographical location information: a certain Beijing mall a;

……

IP address: 189.234.102.18, corresponding geographical location information: a certain Beijing mall b (also in the preset geographic area);

IP address: 189.234.102.10, corresponding geographical location information: a certain Beijing mall b (also in the preset geographic area);

……

counting the IP address information in the same preset geographic area: 189.234.102.109, the number M of IP address information having the same value in the preset IP address field can be obtained.

S305: and judging whether the number is greater than or equal to a preset number threshold value. If the number is greater than or equal to the preset number threshold, go to step S306.

For example, if the preset number threshold is 10 (which may be an empirical value), the obtained number M ≧ 10 indicates the IP address information in the first information set 20: 189.234.102.109, while in the second set of information 10 the confidence level of the geographic location information corresponding to that IP address information is high: 189.234.102.109 the confidence level of the corresponding geographical location information is low.

S306: and replacing the geographical location information corresponding to the IP address information in the second information set 10 with the geographical location information corresponding to the IP address information in the first information set 20, thereby completing the update of the IP information base. In the above example, the geographical location information is: the Beijing supermarket b is replaced by a Beijing mall a.

In this embodiment, the processes in steps S303 to S306 may be executed in a loop, so as to compare the data in the first information set 20 with the data in the second information set 10 one by one, verify the reliability of the geographic location information in the first information set 20 when the geographic location information corresponding to the same IP address information is inconsistent, and replace the geographic location information in the second information set 10 with the geographic location information in the first information set 20 when the reliability is high, thereby implementing data update on the second information set and ensuring the accuracy of the updated data.

In this embodiment of the application, after the step S303 and before the step S306, the method further includes the steps of:

s307: if the geographical location information corresponding to the IP address information in the first information set 20 is not consistent with the geographical location information corresponding to the IP address information in the second information set 10, a first distance between the geographical location information corresponding to the IP address information in the first information set 20 and the geographical location information corresponding to the IP address information in the second information set 10 is determined.

Continuing with the above example, assume that the IP address in the first set of information 20: 189.234.102.109 are: a certain Beijing mall a; and in the second set of information 10: 189.234.102.109 are: and C, calculating a certain Beijing supermarket b, and assuming that the first distance between the certain Beijing supermarket a and the certain Beijing supermarket b is 9 kilometers.

S308: and judging whether the first distance is smaller than or equal to a preset distance threshold value.

Assuming that the predetermined distance threshold is 10 km, in the above example, the first distance (9 km) between the supermarket a and the supermarket b is smaller than the predetermined distance threshold.

In this embodiment, the determination result in step S308 is: "yes", and the determination result in the above step S305 is: if "yes", the process proceeds to step S306. In this embodiment, by adding the steps S307 and S308, the accuracy of the reliability verification process of the geographic location information in the first information set (which needs to satisfy the requirements of the preset number threshold and the preset distance threshold of the similar IPs) can be further improved, so as to improve the accuracy of the IP geographic location update.

Fig. 6 is a flowchart of a method for updating an IP information base according to another embodiment of the present application, and with reference to fig. 6 and fig. 5, the method includes the following steps:

s401: the method comprises the steps of collecting IP address information of network equipment in the Internet and geographic position information corresponding to the IP address information to obtain an information set 20 containing the collected IP address information and the collected geographic position information. The step S401 can refer to the content of the step S301, which is not described herein again.

S402: and grouping the first information set 20 according to the preset geographical area where the geographical position information is located to obtain a grouped set corresponding to each preset geographical area.

As shown in fig. 5, after acquiring the first information set 20, the first information set 20 may be grouped according to preset geographical areas divided in advance to obtain a plurality of grouped sets corresponding to the preset geographical areas, where the grouped sets are respectively: the 1 st grouping set 21 to the kth grouping set 2k, wherein k is more than or equal to 2, and k is a natural number. For example, assuming that the geographic location is divided into 1000 preset geographic areas according to a certain distance range in advance, there are 1000 corresponding packet sets corresponding to each preset geographic area, and the geographic location information corresponding to the IP address stored in each packet set needs to be located in the preset geographic area corresponding to the packet set.

S404: if the IP address information contained in the first information set 20 exists in the second information set 10 to be updated, determining whether the geographic location information corresponding to the IP address information in the first information set 20 is consistent with the geographic location information corresponding to the IP address information in the second information set 10; if not, the process proceeds to step S405.

S405: a preset geographical area where the geographical location information corresponding to the IP address information is located in the first information set 20 is determined, and a packet set corresponding to the preset geographical area is determined.

Continuing by way of example, assume that the IP address in the first set of information 20: 189.234.102.109 are: a certain Beijing mall a; and determining, by matching, the geographic location information: the preset geographical area corresponding to a certain market a in Beijing is as follows: a square circle with "east longitude 20 ° and north latitude 30 °" as the center is 10 km, and further, the following geographic area can be determined: the grouping set corresponding to a square circle with the center of east longitude 20 degrees and north latitude 30 degrees is the s-th grouping set 2s, wherein s is more than or equal to 1 and less than or equal to k.

S406: and judging whether the number of the IP address information with the same value of the IP address information in the preset IP address field in the determined packet set exceeds the number of the IP address information with the same value of the IP address information in the preset IP address field in the rest packet sets. If so, the process proceeds to step S407.

In this embodiment, the IP address information having the same value as the IP address information in the preset IP address field may be distributed in one or more packet sets, and if the IP address information is distributed in at least two packet sets, the number of the IP address information in each packet set that is the same as the value of the IP address information in the preset IP address field may be counted and sorted, so as to obtain the number rank corresponding to each packet set. For example, assume that the IP address in the first set of information 20: 189.234.102.109 are: in a certain Beijing mall a, through statistics, the rest of IP addresses with the same value in the preset IP address field are found to be distributed in three packet sets, which are respectively: 1 st group set 21, 2 nd group set 22, s th group set 2s, where, with the geographical location information: the grouping set corresponding to a certain market a in Beijing is the s-th grouping set 2 s. By statistics, the IP address in the 1 st packet set 21 is obtained: 189.234.102.109 is 10, the number of IP addresses in the preset IP address field is equal to the IP address: 189.234.102.109 is 20, and the number of IP addresses in the s-th packet set 2s is equal to the value of the IP address: 189.234.102.109 is 30, it is finally determined that the number of similar IP addresses in the s-th packet set 2s is greater than the number of similar IP addresses in the remaining packet sets (the 1 st packet set 21, the 2 nd packet set 22).

S407: the geographical location information corresponding to the IP address information in the second set of information 10 is replaced with the geographical location information corresponding to the IP address information in the first set of information 20.

In the above example, since the IP address is associated with the first set of information 20: 189.234.102.109 are: a certain market a in Beijing, and the information about the geographic position is: in a packet set corresponding to a mall a in beijing (the s-th packet set 2s) and the IP address information: 189.234.102.109, the number of pieces of IP address information (i.e., 189.234.102.x, x represents any natural number from 0 to 255) having the same value in the predetermined IP address field is greater than the number of pieces of IP address information in the remaining packet sets (the 1 st packet set 21, the 2 nd packet set 22): 189.234.102.109 in the preset IP address field. The number of similar IPs in the s-th packet set 2s is the largest, which means that the geographical location information is the information about a certain mall a in beijing and the IP address: 189.234.102.109 have the highest degree of engagement (highest confidence). At this time, the IP address information in the second information set 10 may be: 189.234.102.109 corresponding to geographical location information: the "Beijing supermarket b" is replaced by "Beijing mall a".

By executing the processes of the above steps S404 to S407 in a loop, it is possible to realize data update on the second information set and ensure the accuracy of the updated data.

In this embodiment of the application, after the step S404 and before the step S407, the method may further include the steps of:

s408: a first distance is determined between the geographic location information corresponding to the IP address information in the first set of information 20 and the geographic location information corresponding to the IP address information in the second set of information 10.

S409: and judging whether the first distance is smaller than or equal to a preset distance threshold value.

The step S408 and the step S409 may refer to the content of the step S307 and the step S308, and the accuracy of the geographic location update of the IP may be further improved by adding the step S408 and the step S409 in the present embodiment, so that the accuracy of the reliability verification process of the geographic location information in the first information set (the requirement of the preset number threshold and the preset distance threshold of the similar IP needs to be simultaneously satisfied).

In order to further optimize the data updating process, in the embodiment of the present application, a non-dispute information base Q1 and a dispute information base Q2 may be predefined, when it is determined that the reliability of the geographic location information corresponding to an IP address information in the first information set is high, the step S306 or the step S407 may not be immediately performed, but the IP address information with high reliability and the geographic location information corresponding to the IP address information are put into the non-dispute information base Q1, and finally, the data in the non-dispute information base Q1 is not required to be verified, and some data cannot be determined to be the highest reliability, but cannot be directly discarded, and then the data may be put into the dispute information base Q2 to be further verified. Finally, the data in the first information set 20 can be divided into the dispute information base Q1 and the dispute information base Q2, and the data of the same IP address in the dispute information base Q2 can be deleted if the data of the same IP address exists in the dispute information base Q1 and the dispute information base Q2.

Next, a procedure of how to perform the credibility verification on the data of the dispute information base Q2 will be described.

Fig. 7 is a flow chart in an updating method of an IP information base provided on the basis of the embodiment shown in fig. 6, and includes:

s410: and respectively determining the number of the IP address information in each packet set, wherein the number of the IP address information is the same as the value of the IP address information in a preset IP address field. After the above step S404 is executed, the process proceeds to step S410.

S412: and sequencing the quantity corresponding to each grouping set from large to small to obtain the quantity ranking corresponding to each grouping set.

Continuing with the above example, assume that the IP address in the first set of information 20: 189.234.102.109 are: in a certain Beijing mall a, through statistics, the rest of IP addresses with the same value in the preset IP address field are found to be distributed in three packet sets, which are respectively: 1 st group set 21, 2 nd group set 22, s th group set 2s, where, with the geographical location information: the grouping set corresponding to a certain market a in Beijing is the s-th grouping set 2 s. By statistics, the IP address in the 1 st packet set 21 is obtained: 189.234.102.109 is 10, the number of IP addresses in the preset IP address field is equal to the IP address: 189.234.102.109 is 20, and the number of IP addresses in the s-th packet set 2s is equal to the value of the IP address: 189.234.102.109, the number of IP addresses with the same value in the preset IP address field is 30, and finally, the number corresponding to each packet set is sorted from large to small to obtain:

the s-th packet set 2s > the 2 nd packet set 22 > the 1 st packet set 21.

S414: and judging whether the quantity corresponding to the currently determined grouping set is any one of 1 to n, wherein after the step S405 is executed, the step S414 is entered.

If the determination result in the step S414 is yes and the determination result in the step S409 is no, the process proceeds to a step S416.

In the above example, it is assumed that the geographic area determined in step S405 is associated with a preset geographic area: the grouping set corresponding to the square circle 10 km centered on the east longitude 20 degrees and the north latitude 30 degrees is: the s-th packet set 2s, if the number rank corresponding to the s-th packet set 2s is 1, and the IP address in the first information set 20: geographical location information corresponding to "189.234.102.109": "a certain department of Beijing" and the second information set 10: geographical location information corresponding to "189.234.102.109": a first distance (e.g. 9 km) between "a supermarket b in beijing" is smaller than a predetermined distance threshold (e.g. 10 km), and the IP address in the first information set can be identified without any dispute: 189.234.102.109 the geographic location information: the product is put into Q1, where A is a highly reliable one.

On the contrary, if it is found that the IP address is included in the first information set 20: geographical location information corresponding to "189.234.102.109": "a certain department of Beijing" and the second information set 10: geographical location information corresponding to "189.234.102.109": a first distance (e.g., 11 km) between "a certain supermarket b in beijing" is greater than or equal to a preset distance threshold (e.g., 10 km), and the number rank corresponding to the S-th group set 2S is any one of 1 to n (where 2 is equal to or less than n, and n is a natural number), then step S416 may be performed.

S416: the IP address information is determined to be dispute IP address information and the geographical location information corresponding to the dispute IP address information in the first set of information are placed in a dispute information base Q2.

The credibility of the data in the dispute information base Q2 is verified through steps S418, S420, and S422, and if the credibility satisfies the update condition, the process proceeds to step S424. The steps S418, S420, and S422 will be described in detail below.

S424: the geographic location information corresponding to the dispute IP address information in the second set of information 10 is replaced with the geographic location information corresponding to the dispute IP address information in the dispute information base Q2.

In this embodiment of the application, the step S418 may specifically include:

s4181: at least one neighboring IP address information neighboring the dispute IP address information is determined and a second distance between the geographic location information corresponding to the neighboring IP address information in the second set of information 10 and the geographic location information corresponding to the dispute IP address information in the first set of information 20 is determined.

If the last values of one IP address and the other IP address are adjacent, the two IP addresses are defined as the IP addresses adjacent to each other. For example, for an IP address: "189.234.102.109", the IP address adjacent to it is: "189.234.102.108" and "189.234.102.110". Assume that in the second set of information 10 and the IP address: the geographical location information corresponding to "189.234.102.108" is: in a second information set 10 and the IP address of a certain mall b in beijing: the geographical location information corresponding to "189.234.102.110" is: a supermarket c in beijing, together with the dispute IP address information in the first information set 20 (i.e. the dispute information base Q2): the geographical location information corresponding to "189.234.102.109" is: the method comprises the following steps of A, obtaining the following results respectively in Beijing department of market a:

the second distance between the Beijing mall b and the Beijing mall a is 5 km;

the second distance between the Beijing supermarket c and the Beijing mall a is 7 kilometers;

s4182: and judging whether the second distance is greater than or equal to the preset distance threshold value. If the second distance is smaller than the preset distance threshold, go to step S424.

In the above example, if the preset distance threshold is 10 km, the second distance between the "beijing mall b" and the "beijing mall a" and the second distance between the "beijing supermarket c" and the "beijing mall a" are all smaller than 10 km. Through the process of the step S418, the credibility of the data in the dispute information base Q2 can be verified.

In this embodiment of the application, the step S420 may specifically include:

s4201: the first quantity and the second quantity of the IP address information in the dispute information base Q2, which is the same as the value of a dispute IP address information in the preset IP address field in the second information set 10, are respectively determined.

Continuing with the above example, for the dispute IP address information: "189.234.102.109", which is associated with the dispute IP address information in the dispute information base Q2: "189.234.102.109" has a first number of IP address information having the same value in the preset IP address field as 100, which is the same as the dispute IP address information in the second set of information 10: the first number of IP address information of "189.234.102.109" having the same value in the preset IP address field is 80.

S4202: judging whether the first number is larger than m times of the second number; wherein m is more than or equal to 1.

For example, if m is 1.1, it is determined whether the first number is greater than 1.1 times the second number. If yes, the process proceeds to step S4203.

S4203: and judging whether the first quantity and the second quantity are both larger than a basic threshold value. If both the first number and the second number are greater than the basic threshold, the process proceeds to step S424.

In practical situations, it may happen that although the first number is m times larger than the second number, both the first number and the second number are too small (for example, the first number is 2 and the second number is 1), and this situation cannot verify the credibility of the disputed IP address information. To improve the accuracy of the verification, basic thresholds are set, such as: 10. see the first number above: 100 is greater than the second number: 80 and are all greater than 10, it can be determined that the data corresponding to the dispute IP address information in the dispute information base Q2 described above is more trustworthy, can be placed in the dispute-less information base Q1, and finally the second set of information 10 is updated with the data in the dispute-less information base Q1.

In this embodiment of the application, the step S422 may specifically include:

s4221: and respectively determining a first quantity and a second quantity of the IP address information which is in the dispute information base and in the second information set and is the same as the value of the dispute IP address information in a preset IP address field. In step S4221, the content of step S4201 described above may be referred to.

S4222: judging whether the first quantity is larger than the second quantity and whether the first quantity is larger than a basic threshold value; this step S4222 may refer to the content of step S4203 described above.

If the first number is smaller than the second number and the first number is greater than a basic threshold, the process proceeds to step S4223.

S4223: determining a first variance of the geographical location information of each piece of IP address information in the dispute information base Q2, which is the same as the value of the dispute IP address information in the preset IP address field, and determining a second variance of the geographical location information of each piece of IP address information in the second information set 10, which is the same as the value of the dispute IP address information in the preset IP address field;

for example: for dispute IP address information: 189.234.102.109, the IP address information in the dispute information base Q2 which is the same as the value thereof in the preset IP address field includes: 189.234.102.107 (the corresponding geographical location information is x₁) 189.234.102.108 (corresponding geographical location information is x)₂) 189.234.102.166 (the corresponding geographical location information is x₃) (ii) a The IP address information in the second information set 10 that is the same as its value in the preset IP address field includes: 189.234.102.155 (corresponding geographical location information is y₁) 189.234.102.10 (corresponding geographical location information is y)₂) 189.234.102.177 (the corresponding geographical location information is y₃)。

Using the variance calculation formula, one can derive:

first square difference

Wherein,

is x₁、x₂、x₃May be the mean of latitude and longitude.

Second variance

Wherein,

is y₁、y₂、y₃May be the mean of latitude and longitude.

S4224: judging the first variance

Whether or not less than the second variance

If yes, the process proceeds to step S424.

In the embodiment of the present application, through any one or more of the above steps S418, S420, and S422, the obtained data in the dispute information base Q2 are verified one by one, the IP address information with the reliability meeting the requirement (higher reliability) and the geographic location information corresponding to the IP address information are put into the dispute-less information base Q1, and finally the second information set 10 is updated by using the data in the dispute-less information base Q1.

Corresponding to the above method flow, the embodiment of the present application further provides a device for determining trusted IP information and a device for updating an IP information base. The above-mentioned means can be implemented by software, and also can be implemented by hardware or by a combination of software and hardware. In the case of software implementation, the logical device is formed by reading corresponding computer program instructions into a memory through a Central Processing Unit (CPU) of the server and running the computer program instructions.

Fig. 8 is a block diagram of a device for determining trusted IP information according to an embodiment of the present application. The functions implemented by the units included in the apparatus are the same as the functions implemented by the steps included in the method, so the apparatus may refer to the details of the method, and will not be described herein again. In an embodiment of the present application, a device for determining trusted IP information includes:

the system comprises an acquisition unit 101, a processing unit and a processing unit, wherein the acquisition unit 101 is used for acquiring IP address information of network equipment and geographical position information corresponding to the IP address information to form a first information set;

a first determining unit 102, configured to determine a preset geographic area where geographic location information corresponding to the IP address information to be determined is located;

a second determining unit 103, configured to determine, in the first information set, the number of IP address information that is the same as the value of the IP address information to be determined in a preset IP address field and is in the preset geographic area;

a first judging unit 104, configured to judge whether the number is greater than or equal to a preset number threshold;

a determining unit 105, configured to determine, when the number is greater than or equal to a preset number threshold, that the geographic location information corresponding to the to-be-determined IP address information is trusted geographic location information of the IP address information.

In an embodiment of the present application, the apparatus further includes:

the searching unit is used for searching the geographic position information corresponding to the IP address information to be judged in the second information set based on a pre-generated second information set;

a third determining unit, configured to determine a first distance between the collected geographic location information corresponding to the IP address information to be determined and the geographic location information corresponding to the IP address information to be determined in the second information set; the second information set comprises a plurality of pieces of IP address information and geographic position information corresponding to each piece of IP address information.

A second judging unit, configured to judge whether the first distance is smaller than or equal to a preset distance threshold;

accordingly, the determination unit 105 is specifically configured to:

and if the number is greater than or equal to a preset number threshold and the first distance is less than or equal to a preset distance threshold, judging that the geographic position information corresponding to the IP address information to be judged is credible geographic position information of the IP address information.

In another embodiment of the present application, the apparatus for determining trusted IP information includes:

a first determining unit 102, configured to respectively determine, in the first information set, the number of pieces of IP address information that are located in each preset geographic area and that are the same as the value of the IP address information to be determined in a preset IP address field;

a second determining unit 103, configured to determine a preset geographic area where geographic location information corresponding to the IP address information to be determined is located;

a first judging unit 104, configured to judge whether the number corresponding to the determined preset geographic area is greater than the number corresponding to another preset geographic area;

a determining unit 105, configured to determine, when the number corresponding to the determined preset geographic area is greater than the number corresponding to other preset geographic areas, that the geographic location information corresponding to the IP address information to be determined is trusted geographic location information of the IP address information.

In an embodiment of the present application, the apparatus further includes:

the searching unit is used for searching the geographic position information corresponding to the IP address information to be judged in the second information set based on a pre-generated second information set; the second information set comprises a plurality of pieces of IP address information and geographic position information corresponding to each piece of IP address information.

A third determining unit, configured to determine a first distance between the collected geographic location information corresponding to the IP address information to be determined and the geographic location information corresponding to the IP address information to be determined in the second information set;

accordingly, the determination unit 105 is specifically configured to: and if the number corresponding to the determined preset geographic area is larger than the number corresponding to other preset geographic areas, and the first distance is smaller than or equal to a preset distance threshold, judging that the geographic position information corresponding to the IP address information to be judged is the credible geographic position information of the IP address information.

In summary, the device for determining trusted IP information provided in the embodiment of the present application may implement verification of reliability of IP geographic information by determining the number of IP address information in the preset geographic area and having the same value as that of the IP address information to be determined in the preset IP address field, and determining whether the geographic location information corresponding to the IP address information to be determined is the trusted geographic location information of the IP address information according to the number.

Fig. 9 is a block diagram of an apparatus for updating an IP information base according to an embodiment of the present application. The functions implemented by the units included in the apparatus are the same as the functions implemented by the steps included in the method, so the apparatus may refer to the details of the method, and will not be described herein again. The device includes:

the system comprises an acquisition unit 201, a processing unit and a processing unit, wherein the acquisition unit is used for acquiring IP address information of each network device in the Internet and geographical position information corresponding to the IP address information to obtain a first information set containing the acquired IP address information and geographical position information;

a first determining unit 203, configured to determine whether geographic location information corresponding to the IP address information in the first information set is consistent with geographic location information corresponding to the IP address information in the second information set when the IP address information included in the first information set exists in the second information set to be updated;

a first determining unit 204, configured to determine, when the geographic location information corresponding to the IP address information in the first information set is inconsistent with the geographic location information corresponding to the IP address information in the second information set, a preset geographic area where the geographic location information corresponding to the IP address information in the first information set is located, and count the number of IP address information in the preset geographic area in the first information set and having the same value as that of the IP address information in a preset IP address field;

a second determining unit 205, configured to determine whether the number is greater than or equal to a preset number threshold;

a replacing unit 206, configured to replace, when the number is greater than or equal to a preset number threshold, the geographic location information corresponding to the IP address information in the second information set with the geographic location information corresponding to the IP address information in the first information set.

The device can update the data in the second information set by using the data in the first information set, thereby ensuring the accuracy of the updated data.

In an embodiment of the present application, the apparatus further includes:

a second determining unit 207, configured to determine, when the geographic location information corresponding to the IP address information in the first information set is inconsistent with the geographic location information corresponding to the IP address information in the second information set, a first distance between the geographic location information corresponding to the IP address information in the first information set and the geographic location information corresponding to the IP address information in the second information set;

a third determining unit 208, configured to determine whether the first distance is smaller than or equal to a preset distance threshold;

correspondingly, the replacing unit 206 is specifically configured to:

and if the number is greater than or equal to a preset number threshold and the first distance is less than or equal to a preset distance threshold, replacing the geographic position information corresponding to the IP address information in the second information set with the geographic position information corresponding to the IP address information in the first information set.

Fig. 10 is a block diagram of an apparatus for updating an IP information base according to another embodiment of the present application. The functions implemented by the units included in the apparatus are the same as the functions implemented by the steps included in the method, so the apparatus may refer to the details of the method, and will not be described herein again. The device includes:

the system comprises an acquisition unit 301, a processing unit and a processing unit, wherein the acquisition unit 301 is used for acquiring IP address information of each network device in the Internet and geographical position information corresponding to the IP address information to obtain a first information set containing the acquired IP address information and geographical position information;

a grouping unit 302, configured to group the first information set according to a preset geographic area where the geographic location information is located, so as to obtain a grouping set corresponding to each preset geographic area;

a first determining unit 304, configured to determine whether geographic location information corresponding to the IP address information in the first information set and geographic location information corresponding to the IP address information in the second information set are consistent when the IP address information included in the first information set exists in the second information set to be updated;

a first determining unit 305, configured to determine, when the geographic location information corresponding to the IP address information in the first information set is inconsistent with the geographic location information corresponding to the IP address information in the second information set, a preset geographic area where the geographic location information corresponding to the IP address information in the first information set is located, and determine a packet set corresponding to the preset geographic area;

a second judging unit 306, configured to judge whether the number of pieces of IP address information in the determined packet set, which is the same as the value of the IP address information in the preset IP address field, exceeds the number of pieces of IP address information in the remaining packet sets, which is the same as the value of the IP address information in the preset IP address field;

a replacing unit 307, configured to replace, when the number is greater than or equal to a preset number threshold, the geographic location information corresponding to the IP address information in the second information set with the geographic location information corresponding to the IP address information in the first information set.

In an embodiment of the present application, the apparatus further includes:

a second determining unit 308, configured to determine, when the geographic location information corresponding to the IP address information in the first information set is inconsistent with the geographic location information corresponding to the IP address information in the second information set, a first distance between the geographic location information corresponding to the IP address information in the first information set and the geographic location information corresponding to the IP address information in the second information set;

a third determining unit 309, configured to determine whether the first distance is smaller than or equal to a preset distance threshold;

accordingly, the replacing unit 307 is specifically configured to:

if the number of the IP address information in the determined packet set, which is the same as the value of the IP address information in the preset IP address field, exceeds the number of the IP address information in the rest packet sets, which is the same as the value of the IP address information in the preset IP address field, and the first distance is smaller than or equal to a preset distance threshold value, replacing the geographic position information corresponding to the IP address information in the second information set with the geographic position information corresponding to the IP address information in the first information set.

In an embodiment of the present application, the apparatus further includes:

a third determining unit, configured to determine, in each packet set, the number of pieces of IP address information that is the same as a value of the IP address information in a preset IP address field;

the sorting unit is used for sorting the quantity corresponding to each grouping set from large to small to obtain the quantity ranking corresponding to each grouping set;

a fourth determining unit, configured to determine, when the first distance is greater than a preset distance threshold and a number corresponding to a currently determined packet set is any one of 1 to n, the IP address information as dispute IP address information; wherein n is more than or equal to 2 and is a natural number;

a fifth determining unit, configured to determine at least one piece of adjacent IP address information adjacent to the dispute IP address information, and determine a second distance between the geographic location information corresponding to the adjacent IP address information in the second information set and the geographic location information corresponding to the dispute IP address information in the first information set;

a fourth judging unit, configured to judge whether the second distance is greater than or equal to the preset distance threshold;

accordingly, the replacing unit 307 is specifically configured to:

and if the second distance is smaller than the preset distance threshold, replacing the geographic position information corresponding to the dispute IP address information in the second information set with the geographic position information corresponding to the dispute IP address information in the first information set.

In an embodiment of the present application, the apparatus further includes:

a fourth determining unit, configured to determine, when the first distance is greater than a preset distance threshold and a number corresponding to a currently determined packet set is any one of 1 to n, the IP address information as dispute IP address information, and place the dispute IP address information and geographic location information corresponding to the dispute IP address information in the first information set into a dispute information base; wherein n is more than or equal to 2 and is a natural number;

a fifth determining unit, configured to determine a first quantity and a second quantity of the IP address information in the dispute information base and in the second information set, where the first quantity and the second quantity are the same as values of some dispute IP address information in a preset IP address field;

a fourth judging unit configured to judge whether the first number is greater than m times the second number; wherein m is more than or equal to 1;

a fifth judging unit, configured to judge whether the first number and the second number are both greater than a basic threshold when the first number is greater than m times the second number;

accordingly, the replacing unit 307 is specifically configured to:

and if the first quantity and the second quantity are both larger than a basic threshold value, replacing the geographic position information corresponding to the dispute IP address information in the second information set with the geographic position information corresponding to the dispute IP address information in the dispute information base.

In an embodiment of the present application, the apparatus further includes:

a fourth judging unit, configured to judge whether the first number is greater than the second number and whether the first number is greater than a basic threshold;

a sixth determining unit, configured to determine, when the first number is smaller than the second number and the first number is greater than a basic threshold, a first variance of the geographic location information of each piece of IP address information in the dispute information base that is the same as a value of the dispute IP address information in a preset IP address field, and determine a second variance of the geographic location information of each piece of IP address information in the second information set that is the same as the value of the dispute IP address information in the preset IP address field;

a fifth judgment unit configured to judge whether the first variance is smaller than the second variance;

accordingly, the replacing unit 307 is specifically configured to:

and if the first variance is smaller than the second variance, replacing the geographic position information corresponding to the dispute IP address information in the second information set with the geographic position information corresponding to the dispute IP address information in the dispute information base.

In summary, in the updating apparatus of the IP information base, whether a certain IP address information and the geographic location information corresponding to the certain IP address information are trusted or not may be determined according to the above principle, and if the certain IP address information and the geographic location information corresponding to the certain IP address information are trusted, the geographic location information corresponding to the certain IP address information in the second information set is replaced with the geographic location information corresponding to the certain IP address information in the first information set, so as to complete the updating of the second information set, thereby ensuring the accuracy of the data in the second information set.

For convenience of description, the above devices are described as being divided into various units by function, and are described separately. Of course, the functionality of the units may be implemented in one or more software and/or hardware when implementing the present application.

As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.

As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

The application may be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The application may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules may be located in both local and remote computer storage media including memory storage devices.

The embodiments in this specification are all described in a progressive manner, and the same parts in the preset IP address field with the same values in the embodiments are referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for the system embodiment, since it is substantially similar to the method embodiment, the description is simple, and for the relevant points, reference may be made to the partial description of the method embodiment.

The above description is only an example of the present application and is not intended to limit the present application. Various modifications and changes may occur to those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A method for determining trusted IP information, comprising:

determining the number of the IP address information which is the same as the value of the IP address information to be judged in a preset IP address field and is in the preset geographic area in the first information set; determining a first distance between the geographic position information corresponding to the IP address information to be judged and the geographic position information corresponding to the IP address information to be judged in a pre-generated second information set; the second information set comprises a plurality of pieces of IP address information and geographic position information corresponding to each piece of IP address information;

judging whether the number is greater than or equal to a preset number threshold value; judging whether the first distance is smaller than or equal to a preset distance threshold value or not;

2. A method for determining trusted IP information, comprising:

respectively determining the number of IP address information which is positioned in each preset geographic area and has the same value as the IP address information to be judged in a preset IP address field in the first information set; determining a first distance between the geographic position information corresponding to the IP address information to be judged and the geographic position information corresponding to the IP address information to be judged in a pre-generated second information set; the second information set comprises a plurality of pieces of IP address information and geographic position information corresponding to each piece of IP address information;

judging whether the number corresponding to the determined preset geographic area is greater than the number corresponding to other preset geographic areas; judging whether the first distance is smaller than or equal to a preset distance threshold value or not;

and if the number corresponding to the determined preset geographic area is larger than the number corresponding to other preset geographic areas, and the first distance is smaller than or equal to a preset distance threshold, judging that the geographic position information corresponding to the IP address information to be judged is the credible geographic position information of the IP address information.

3. An updating method of an IP information base is characterized by comprising the following steps:

if the IP address information is inconsistent with the preset IP address field value, determining a preset geographical area where the geographical position information corresponding to the IP address information in the first information set is located, and counting the number of the IP address information in the first information set, wherein the IP address information is the same as the IP address information in the preset IP address field value; determining a first distance between the geographical location information corresponding to the IP address information in the first information set and the geographical location information corresponding to the IP address information in the second information set;

4. An updating method of an IP information base is characterized by comprising the following steps:

if the IP address information is inconsistent with the preset geographic area, determining the preset geographic area where the geographic position information corresponding to the IP address information in the first information set is located, and determining a packet set corresponding to the preset geographic area; determining a first distance between the geographical location information corresponding to the IP address information in the first information set and the geographical location information corresponding to the IP address information in the second information set;

judging whether the number of the IP address information with the same value of the IP address information in a preset IP address field in the determined packet set exceeds the number of the IP address information with the same value of the IP address information in the preset IP address field in the rest packet sets; judging whether the first distance is smaller than or equal to a preset distance threshold value or not;

5. The method of claim 4, further comprising:

if the geographic position information corresponding to the IP address information in the first information set is inconsistent with the geographic position information corresponding to the IP address information in the second information set, respectively determining the number of the IP address information in each packet set, wherein the number of the IP address information is the same as the value of the IP address information in a preset IP address field;

sorting the quantity corresponding to each grouping set from large to small to obtain quantity ranking corresponding to each grouping set;

after determining whether the first distance is less than or equal to a preset distance threshold, the method further includes:

if the first distance is larger than a preset distance threshold value and the number corresponding to the currently determined packet set is any one of 1 to n, determining the IP address information as dispute IP address information; wherein n is more than or equal to 2 and is a natural number;

determining at least one piece of adjacent IP address information adjacent to the dispute IP address information, and determining a second distance between the geographic position information corresponding to the adjacent IP address information in the second information set and the geographic position information corresponding to the dispute IP address information in the first information set;

judging whether the second distance is greater than or equal to the preset distance threshold value;

6. The method of claim 4, further comprising:

if the first distance is larger than a preset distance threshold value and the number corresponding to the currently determined packet set is any one of 1 to n, determining the IP address information as dispute IP address information, and putting the dispute IP address information and the geographical position information corresponding to the dispute IP address information in the first information set into a dispute information base; wherein n is more than or equal to 2 and is a natural number;

respectively determining a first quantity and a second quantity of IP address information which are in the dispute information base and in the second information set and have the same value with a dispute IP address information in a preset IP address field;

judging whether the first number is larger than m times of the second number; wherein m is more than or equal to 1;

if so, judging whether the first quantity and the second quantity are both larger than a basic threshold value;

7. The method of claim 4, further comprising:

judging whether the first quantity is larger than the second quantity or not and whether the first quantity is larger than a basic threshold or not;

if the first number is smaller than the second number and the first number is larger than a basic threshold value, determining a first variance of the geographic position information of each IP address information in the dispute information base, which is the same as the value of the dispute IP address information in a preset IP address field, and determining a second variance of the geographic position information of each IP address information in the second information set, which is the same as the value of the dispute IP address information in the preset IP address field;

judging whether the first variance is smaller than the second variance;

if so, replacing the geographic position information corresponding to the dispute IP address information in the second information set with the geographic position information corresponding to the dispute IP address information in the dispute information base.

8. An apparatus for determining trusted IP information, comprising:

a second determining unit, configured to determine, in the first information set, the number of pieces of IP address information that are the same as the value of the to-be-determined IP address information in a preset IP address field and are in the preset geographic area; determining a first distance between the geographic position information corresponding to the IP address information to be judged and the geographic position information corresponding to the IP address information to be judged in a pre-generated second information set; the second information set comprises a plurality of pieces of IP address information and geographic position information corresponding to each piece of IP address information;

the first judging unit is used for judging whether the number is greater than or equal to a preset number threshold value or not; judging whether the first distance is smaller than or equal to a preset distance threshold value or not;

and the judging unit is used for judging that the geographic position information corresponding to the IP address information to be judged is the credible geographic position information of the IP address information when the number is greater than or equal to a preset number threshold and the first distance is less than or equal to a preset distance threshold.

9. An apparatus for determining trusted IP information, comprising:

a first determining unit, configured to determine, in the first information set, the number of pieces of IP address information that are located in each preset geographic area and that are the same as values of the pieces of IP address information to be determined in a preset IP address field, respectively; determining a first distance between the geographic position information corresponding to the IP address information to be judged and the geographic position information corresponding to the IP address information to be judged in a pre-generated second information set; the second information set comprises a plurality of pieces of IP address information and geographic position information corresponding to each piece of IP address information;

a first judging unit, configured to judge whether the number corresponding to the determined preset geographic area is greater than the number corresponding to another preset geographic area; judging whether the first distance is smaller than or equal to a preset distance threshold value or not;

and the judging unit is used for judging that the geographic position information corresponding to the IP address information to be judged is the credible geographic position information of the IP address information when the number corresponding to the determined preset geographic area is larger than the number corresponding to other preset geographic areas and the first distance is smaller than or equal to a preset distance threshold value.

10. An apparatus for updating an IP information base, comprising:

a first determining unit, configured to determine, when geographic location information corresponding to the IP address information in the first information set is inconsistent with geographic location information corresponding to the IP address information in the second information set, a preset geographic area where the geographic location information corresponding to the IP address information in the first information set is located, and count the number of IP address information in the first information set that is the same as a value of the IP address information in a preset IP address field; determining a first distance between the geographical location information corresponding to the IP address information in the first information set and the geographical location information corresponding to the IP address information in the second information set;

a second judging unit, configured to judge whether the number is greater than or equal to a preset number threshold; judging whether the first distance is smaller than or equal to a preset distance threshold value or not;

and the replacing unit is used for replacing the geographic position information corresponding to the IP address information in the second information set with the geographic position information corresponding to the IP address information in the first information set when the number is greater than or equal to a preset number threshold and the first distance is less than or equal to a preset distance threshold.

11. An apparatus for updating an IP information base, comprising:

a first determining unit, configured to determine, when geographic location information corresponding to the IP address information in the first information set is inconsistent with geographic location information corresponding to the IP address information in the second information set, a preset geographic area in which the geographic location information corresponding to the IP address information in the first information set is located, and determine a packet set corresponding to the preset geographic area; determining a first distance between the geographical location information corresponding to the IP address information in the first information set and the geographical location information corresponding to the IP address information in the second information set;

a second judging unit, configured to judge whether the number of pieces of IP address information in the determined packet set, which is the same as the value of the IP address information in the preset IP address field, exceeds the number of pieces of IP address information in the remaining packet sets, which is the same as the value of the IP address information in the preset IP address field; judging whether the first distance is smaller than or equal to a preset distance threshold value or not;

and a replacing unit, configured to replace the geographic location information corresponding to the IP address information in the second information set with the geographic location information corresponding to the IP address information in the first information set when the determined number of pieces of IP address information in the packet set, which is the same as the value of the IP address information in the preset IP address field, exceeds the number of pieces of IP address information in the remaining packet sets, which is the same as the value of the IP address information in the preset IP address field, and the first distance is less than or equal to a preset distance threshold.

12. The apparatus of claim 11, further comprising:

the replacement unit is specifically configured to:

13. The apparatus of claim 11, further comprising:

the replacement unit is specifically configured to:

14. The apparatus of claim 11, further comprising:

the replacement unit is specifically configured to: