CN112215358B - IP positioning method and system based on random forest - Google Patents
IP positioning method and system based on random forest Download PDFInfo
- Publication number
- CN112215358B CN112215358B CN202011424851.0A CN202011424851A CN112215358B CN 112215358 B CN112215358 B CN 112215358B CN 202011424851 A CN202011424851 A CN 202011424851A CN 112215358 B CN112215358 B CN 112215358B
- Authority
- CN
- China
- Prior art keywords
- landmark
- landmarks
- overtime
- random forest
- address
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N7/00—Computing arrangements based on specific mathematical models
- G06N7/01—Probabilistic graphical models, e.g. probabilistic networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L61/00—Network arrangements, protocols or services for addressing or naming
- H04L61/50—Address allocation
- H04L61/5007—Internet protocol [IP] addresses
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2101/00—Indexing scheme associated with group H04L61/00
- H04L2101/60—Types of network addresses
- H04L2101/69—Types of network addresses using geographic information, e.g. room number
Abstract
The application discloses an IP positioning method and system based on random forests, which solve the problem that the accuracy of an IP address database in the existing IP positioning is not enough, and the requirement of the safety field on the accuracy of the IP positioning cannot be met. The method comprises the following steps: setting at least two detection servers as anchor points; obtaining at least two landmarks by comparing at least two IP address databases; network detection is carried out between all anchor points and all landmarks, and time delay information between all anchor points and all landmarks is obtained; carrying out random forest training according to the time delay information to obtain an IP positioning model based on random forests; and inputting the IP address to be inquired into an IP positioning model based on a random forest to obtain the IP geographical position of the IP address to be inquired.
Description
Technical Field
The invention relates to the field of networks, in particular to an IP positioning method and system based on a random forest.
Background
The IP positioning is to determine the specific geographical position of the equipment according to the IP address of the network equipment, and the IP positioning function plays a vital role in the fields of positioning targets and network security. In the field of network security, the geographical location of the IP address of the computer initiating the attack behavior is very important information for security situation awareness, and IP positioning is required to play a role.
The most common method for IP positioning is to query an IP address database, the database provides relevant information of countries, provinces, cities and the like for users, correct IP positioning information can be found by comparing the existing databases, and the common IP address databases are Maxmind GeoIP2 and IP2 location.
However, although the existing IP address database provides relevant information for users, the accuracy of the IP address database is not sufficient, and there is no way to meet the accuracy requirement of the security field for IP positioning.
Disclosure of Invention
The invention aims to provide an IP positioning method and system based on a random forest, which utilize the principle that time delay and distance are positively correlated, obtain time delay information of each anchor point to a landmark through network detection of the anchor point and the landmark, perform random forest training on the time delay information to obtain an IP positioning model based on the random forest, and can position an IP geographical position through an IP address to be inquired by using the IP positioning model based on the random forest, thereby solving the problem that the accuracy of an IP address database in the existing IP positioning is insufficient, and the accuracy requirement of the safety field on the IP positioning cannot be met.
The invention provides an IP positioning method based on random forest, comprising the following steps:
setting at least two detection servers as anchor points, wherein each anchor point has a corresponding IP address and an IP geographic position;
obtaining at least two landmarks by comparing at least two IP address databases, wherein each landmark has a corresponding IP address and an IP geographic position;
network detection is carried out between all anchor points and all landmarks, and time delay information between all anchor points and all landmarks is obtained;
carrying out random forest training according to the time delay information to obtain an IP positioning model based on random forests;
and inputting the IP address to be inquired into an IP positioning model based on a random forest to obtain the IP geographical position of the IP address to be inquired.
Further, network detection is performed between all anchor points and all landmarks, and time delay information between all anchor points and all landmarks is obtained, which includes:
network detection is carried out between each anchor point and all landmarks, and detection time from all anchor points to all landmarks is obtained;
judging whether an overtime landmark responding overtime exists or not according to the detection time;
if no overtime landmark exists, obtaining time delay information between all anchor points and all landmarks according to the detection time;
if the overtime landmark exists, judging whether the overtime response times of the overtime landmark exceed a first preset time;
if the number of times of the detection of the area landmarks exceeds the first preset number of times, determining the area landmarks in the preset area range of the overtime landmarks, calculating the average value of the detection time of the area landmarks, replacing the average value with the detection time of the overtime landmarks and the corresponding anchor points, and obtaining time delay information between all anchor points and all landmarks;
if the number of times exceeds the preset number, determining at least one router on a route tracking path between the overtime landmark and the corresponding anchor point through a route tracking technology;
and carrying out network detection on the router instead of the overtime landmark to obtain time delay information between all anchor points and all landmarks.
Further, the router replaces the overtime landmark to perform network detection, and obtains the time delay information between all anchors and all landmarks, including:
selecting a nearest one-hop router which is nearest to an anchor point on a route tracking path from routers, wherein the nearest one-hop router does not exceed a preset hop number from an overtime landmark;
judging whether the nearest one-hop router and the anchor point can carry out network detection;
if not, discarding the overtime landmarks to obtain time delay information between all anchor points and all landmarks except the overtime landmarks;
if yes, the latest one-hop router replaces an overtime landmark and a corresponding anchor point to carry out network detection, and the detection time of the router is obtained;
judging whether an overtime response exists according to the detection time of the router;
if no overtime response exists, replacing the detection time of the router with the detection time corresponding to the overtime landmark to obtain time delay information between all anchors and all landmarks;
if yes, judging whether the overtime response times of the nearest one-hop router exceed a second preset time;
if the number of times does not exceed the second preset number of times, replacing the detection time of the router with the detection time corresponding to the overtime landmark to obtain time delay information between all anchor points and all landmarks;
if the number of times exceeds the second preset number, the overtime landmarks are discarded, and the time delay information between all anchor points and all landmarks except the overtime landmarks is obtained.
Further, comparing the at least two IP address databases to obtain at least two landmarks, comprising:
searching at least two IP address databases to obtain at least two IP data sets, wherein each IP data set has the same number of IP data, and the IP data comprises IP addresses and IP geographic positions;
comparing all the IP data sets, and selecting consistent IP data with the same IP address and the same IP geographical position, wherein the consistent IP data comprises at least two IP data;
and obtaining a landmark set according to the consistent IP data, wherein one landmark in the landmark set corresponds to one consistent IP data.
Further, the method further comprises:
dividing the landmark set into a landmark training set and a landmark testing set, wherein the landmark training set is provided with N landmarks, N is a positive integer not less than 2, and the landmark testing set comprises at least two testing landmarks.
Further, the number of anchor points is M, M is a positive integer not less than 2,
before random forest training is carried out according to the time delay information and an IP positioning model based on the random forest is obtained, the method further comprises the following steps:
and forming an N-M characteristic matrix according to the M anchor points and the N landmarks in the landmark training set, wherein the characteristic matrix has M characteristic dimensions, and one characteristic dimension is time delay information between one anchor point and the N landmarks.
Further, performing random forest training according to the time delay information to obtain an IP positioning model based on a random forest, including:
taking the time delay information between each anchor point and the N landmarks as a characteristic dimension to obtain M characteristic dimensions;
obtaining a feature matrix of N x M according to the M feature dimensions;
and carrying out random forest training according to the N-M characteristic matrix to obtain an IP positioning model based on a random forest.
Further, after random forest training is performed according to the N × M feature matrix to obtain an IP positioning model based on a random forest, the method further includes:
acquiring test IP data of the landmark test centralized test landmark, and analyzing the test IP data to obtain a test IP address and a test IP geographical position;
inputting the test IP address into an IP positioning model based on a random forest to obtain a positioning IP geographical position;
counting the test accuracy according to the test IP geographical position and the positioning IP geographical position;
if the test accuracy does not reach the threshold value, retraining the IP positioning model based on the random forest;
if the testing accuracy reaches the threshold value, an IP positioning model based on the random forest is reserved.
Further, the IP geographical position comprises information of country, province and city; the preset area range of the overtime landmark is the city of the overtime landmark.
The second aspect of the present invention provides an IP positioning system based on random forest, comprising:
anchor point setting module, landmark obtaining module, network detection module, model training module and positioning module
The anchor setting module executes the random forest-based IP positioning method in the first aspect to set at least two detection servers as anchors, and each anchor has a corresponding IP address and IP geographic position;
the landmark acquisition module executes the random forest-based IP positioning method in the first aspect to acquire at least two landmarks, wherein each landmark has a corresponding IP address and IP geographic position;
the network detection module executes the IP positioning method based on the random forest in the first aspect to detect the time delay information between all anchor points and all landmarks;
the model training module executes the IP positioning method based on the random forest in the first aspect to train so as to obtain an IP positioning model based on the random forest;
and the positioning module executes the IP positioning method based on the random forest in the first aspect to obtain the IP geographic position of the IP address to be inquired through the IP positioning model based on the random forest.
According to the random forest based IP positioning method, at least two detection servers are set as anchor points, each anchor point is provided with a corresponding IP address and a corresponding IP geographical position, at least two landmarks are obtained by comparing at least two IP address databases, each landmark is provided with a corresponding IP address and a corresponding IP geographical position, network detection is carried out between all anchor points and all landmarks, time delay information between all anchor points and all landmarks is obtained, random forest training is carried out according to the time delay information to obtain a random forest based IP positioning model, the IP address to be inquired is input into the random forest based IP positioning model, and the target IP geographical position of the IP address to be inquired is obtained. By utilizing the principle that time delay and distance are positively correlated, random forest training is carried out on the time delay information to obtain the IP positioning model based on the random forest by using the time delay information of each anchor point to the landmark, which is obtained by network detection of the anchor point and the landmark, and the IP geographic position can be positioned by the IP positioning model based on the random forest through the IP address to be inquired, so that the problem that the accuracy of an IP address database in the existing IP positioning is insufficient and the precision requirement of the safety field to the IP positioning can not be met is solved.
Drawings
In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments described in the present application, and other drawings can be obtained by those skilled in the art without creative efforts.
FIG. 1 is a schematic flow chart of an embodiment of a random forest-based IP positioning method provided by the present invention;
FIG. 2 is a schematic flow chart of another embodiment of the IP positioning method based on the random forest according to the present invention;
FIG. 3 is a schematic diagram of an anchor point and landmark provided by the present invention;
FIG. 4 is a schematic diagram of a router for routing trace paths provided by the present invention;
FIG. 5 is a schematic flow chart of another embodiment of the IP positioning method based on the random forest according to the present invention;
fig. 6 is a schematic structural diagram of an embodiment of the IP positioning system based on random forest provided in the present invention.
Detailed Description
The core of the invention is to provide an IP positioning method and system based on random forest, which utilizes the principle that time delay and distance are positively correlated, obtains the time delay information of each anchor point to a landmark through network detection of the anchor point and the landmark, carries out random forest training on the time delay information to obtain an IP positioning model based on random forest, and can position the IP geographical position through the IP address to be inquired by using the IP positioning model based on random forest, thereby solving the problem that the accuracy of an IP address database in the existing IP positioning is insufficient, and the accuracy requirement of the safety field on IP positioning can not be met.
In order to make those skilled in the art better understand the technical solutions in the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
It will be understood that when an element is referred to as being "fixed" or "disposed" on another element, it can be directly on the other element or be indirectly disposed on the other element; when an element is referred to as being "connected to" another element, it can be directly connected to the other element or be indirectly connected to the other element.
It will be understood that the terms "length," "width," "upper," "lower," "front," "rear," "left," "right," "vertical," "horizontal," "top," "bottom," "inner," "outer," and the like, refer to an orientation or positional relationship illustrated in the drawings for convenience in describing the present application and to simplify description, and do not indicate or imply that the referenced device or element must have a particular orientation, be constructed and operated in a particular orientation, and thus should not be construed as limiting the present application.
Furthermore, the terms "first", "second" and "first" are used for descriptive purposes only and are not to be construed as indicating or implying relative importance or implicitly indicating the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of the present application, "plurality" or "a plurality" means two or more unless specifically limited otherwise.
It should be understood that the structures, ratios, sizes, and the like shown in the drawings are only used for matching the disclosure of the specification, so as to be understood and read by those skilled in the art, and are not used to limit the practical limit conditions of the present application, so that the modifications of the structures, the changes of the ratio relationships, or the adjustment of the sizes, do not have the technical essence, and the modifications, the changes of the ratio relationships, or the adjustment of the sizes, are all within the scope of the technical contents disclosed in the present application without affecting the efficacy and the achievable purpose of the present application.
The embodiments of the present application are written in a progressive manner.
Referring to fig. 1, an embodiment of the present invention provides an IP positioning method based on a random forest, including:
101. setting at least two detection servers as anchor points, wherein each anchor point has a corresponding IP address and an IP geographic position;
in this embodiment, the probe server is a server device that has a true and valid IP address and IP geographical location and can be used to perform network probing. The number of the detection servers is at least two, for example, generally, M (M > =250) detection servers need to be deployed nationwide, there are 34 provincial administrative districts (including 23 provinces, 5 autonomous districts, 4 direct prefectures and 2 special administrative districts) in China, and 3 detection servers are configured in a machine room of an operator of each province (china mobile, china telecom and china Unicom respectively), that is, there are 9 detection servers in each provincial administrative district, and because some provincial administrative districts are inconvenient to erect the detection servers, the number of the detection servers is M (M > = 250). The M fixed probe servers are used as anchor points. And each anchor point has a corresponding IP address and IP geographic location.
It should be noted that the IP geographic location may specifically include information of a country, a province, a city, and the like.
102. Obtaining at least two landmarks by comparing at least two IP address databases, wherein each landmark has a corresponding IP address and an IP geographic position;
in this embodiment, the landmark is a host device that obtains a real and effective IP address and an IP geographic location (information of country, province, city, and the like) through an IP address database, and the common IP address database includes Maxmind GeoIP2 and IP2 location.
Optionally, the specific landmark obtaining manner is as follows:
1. searching at least two IP address databases to obtain at least two IP data sets, wherein each IP data set has the same number of IP data, and the IP data comprises IP addresses and IP geographic positions;
for example, two of Maxmind GeoIP2 and IP2location are selected for comparison, two IP data sets are randomly selected from two databases, each IP data set has 500 ten thousand IP data, and the IP data comprises an IP address and an IP geographic position;
2. comparing all the IP data sets, and selecting consistent IP data with the same IP address and the same IP geographical position, wherein the consistent IP data comprises at least two IP data;
for example, 500 ten thousand pieces of IP data in each of the two IP data sets are compared, and identical IP data having both IP addresses and having the same IP geographical location corresponding to the IP addresses are selected, assuming that 50 ten thousand pieces of IP data are used.
3. And obtaining a landmark set according to the consistent IP data, wherein one landmark in the landmark set corresponds to one consistent IP data.
For example, taking the host devices corresponding to 50 ten thousand pieces of consistent IP data as landmarks, a landmark set of 50 ten thousand landmarks is obtained, and in order to better acquire data nationwide, the landmarks in the landmark set are required to be acquired IP addresses and real IP geographic locations including 34 provinces, municipalities and 200 cities.
Optionally, for the requirement of model training, the landmark set may be further divided into a landmark training set and a landmark testing set, where the landmark training set has N landmarks, N is a positive integer not less than 2, and the landmark testing set includes at least two testing landmarks, for example, 70% of the landmark set is used as the landmark training set, and the other 30% of the landmark set is used as the landmark testing set.
103. Network detection is carried out between all anchor points and all landmarks, and time delay information between all anchor points and all landmarks is obtained;
in this embodiment, the specific meaning of the network probe is: data is transmitted from the probe server through the Internet to the target host, which is a host device, i.e., a landmark, that wants to obtain its IP geographical location through an IP positioning method. The method comprises the steps of using an anchor point to conduct network detection on all landmarks to obtain time delay information of the anchor point and all landmarks, and influencing the quality of the network detection according to a series of reasons such as distance, network quality and the like, so that the time delay information can represent the geographical position relation of the anchor point and each landmark, conducting network detection on all anchor points, and obtaining the time delay information between all anchor points and all landmarks.
104. Carrying out random forest training according to the time delay information to obtain an IP positioning model based on random forests;
in this embodiment, the random forest is a common method in machine learning, and the thought behind the random forest is more mutually mapped with group wisdom, even "invisible hands". The algorithm of the classification tree invented by Breiman et al (Breiman et al, 1984) in the eighties of the last century greatly reduced the amount of calculation by performing classification or regression through repeated dichotomous data. In 2001 Breiman combined classification trees into random forests (Breiman 2001 a), i.e., randomized over the use of variables (columns) and data (rows), generated many classification trees, and then summarized the results of the classification trees. The random forest improves the prediction precision on the premise that the calculation amount is not obviously improved. Random forests are insensitive to multivariate common linearity, the result is more stable to missing data and unbalanced data, the effect of thousands of interpretation variables can be well predicted (Breiman 2001 b), and the method is known as one of the best current algorithms. As the name suggests, a random forest is established in a random mode, a plurality of decision trees are arranged in the forest, and each decision tree of the random forest is not related. After a forest is obtained, when a new input sample enters, each decision tree in the forest is judged, the class to which the sample belongs is seen (for a classification algorithm), and then the class is chosen the most, so that the sample is predicted to be the class;
and (3) taking the time delay information between all anchor points and all landmarks as input samples, and training by using a random forest to obtain an IP positioning model based on the random forest.
Before this step, an N × M feature matrix may be formed according to M anchor points and N landmarks in the landmark training set, where the feature matrix has M feature dimensions, and one feature dimension is time delay information between one anchor point and N landmarks.
Optionally, the specific implementation process of step 104 is as follows:
(1) taking the time delay information between each anchor point and the N landmarks as a characteristic dimension to obtain M characteristic dimensions;
(2) obtaining a feature matrix of N x M according to the M feature dimensions;
(3) carrying out random forest training according to the N-M characteristic matrix to obtain an IP positioning model based on a random forest;
(4) after the IP positioning model based on the random forest is obtained, test IP data of a landmark test centralized test landmark are obtained, and the test IP data are analyzed to obtain a test IP address and a test IP geographic position;
(5) inputting the test IP address into an IP positioning model based on a random forest to obtain a positioning IP geographical position;
(6) counting the test accuracy according to the test IP geographical position and the positioning IP geographical position;
(7) if the test accuracy does not reach the threshold value, retraining the IP positioning model based on the random forest;
(8) and if the testing accuracy reaches a threshold value, reserving an IP positioning model based on the random forest.
105. And inputting the IP address to be inquired into an IP positioning model based on a random forest to obtain the IP geographical position of the IP address to be inquired.
In this embodiment, after the IP positioning model based on the random forest is obtained, the IP address to be queried is input into the IP positioning model based on the random forest, and the IP positioning result, that is, the IP geographical position of the IP address to be queried, can be output.
In the embodiment of the invention, by utilizing the principle that the time delay is positively correlated with the distance, the time delay information of each anchor point to the landmark is obtained by network detection of the anchor points and the landmarks, random forest training is carried out on the time delay information to obtain an IP positioning model based on random forests, and the IP geographic position can be positioned by the IP address to be inquired by using the IP positioning model based on the random forests, so that the problems that the accuracy of an IP address database in the existing IP positioning is insufficient and the requirement of the safety field on the precision of the IP positioning can not be met are solved.
In the above embodiment shown in fig. 1, when the network probing function is used, the quality of network probing may be affected according to a series of reasons, such as distance, network quality, etc., that is, there may be some landmarks with timeout responses. The timeout response has a certain effect on the accuracy of the time delay information, and therefore, the following embodiments are needed to explain the processing manner when the timeout response exists.
Referring to fig. 2, an embodiment of the present invention provides an IP positioning method based on a random forest, including:
201. setting at least two detection servers as anchor points, wherein each anchor point has a corresponding IP address and an IP geographic position;
please refer to step 101 of the embodiment shown in fig. 1 for details.
202. Obtaining at least two landmarks by comparing at least two IP address databases, wherein each landmark has a corresponding IP address and an IP geographic position;
please refer to step 102 of the embodiment shown in fig. 1 for details.
203. Network detection is carried out between each anchor point and all landmarks, and detection time from all anchor points to all landmarks is obtained;
in this embodiment, as shown in fig. 3, it is assumed that there are a landmark 1, a landmark 2, a landmark 3, a landmark 4, and a landmark N, and the anchor has an anchor 1 and an anchor 2, and network detection is performed between the anchor 1 and all landmarks, and network detection is performed between the anchor 2 and all landmarks, so as to obtain detection time from all anchors to all landmarks.
204. Judging whether an overtime landmark responding overtime exists or not according to the detection time; if no timeout landmark exists, go to step 205; if yes, go to step 206;
in this embodiment, it is determined whether there is an overtime landmark for overtime response according to the detection time, and if there is no overtime response for all landmarks, it is determined that there is no overtime landmark, and step 205 is executed; assuming that the probe times of anchor 1 and landmark 1 are timed out, landmark 1 is the timed-out landmark with the timeout response, and step 206 is performed.
205. Obtaining time delay information between all anchor points and all landmarks according to the detection time;
in this embodiment, in the case that no overtime landmark exists, the detection times from all anchors to all landmarks are collected to obtain the time delay information between all anchors and all landmarks.
206. Judging whether the overtime response times of the overtime landmarks exceed a first preset time; if the first preset number of times is not exceeded, go to step 207; if the first preset number of times is exceeded, go to step 208;
in this embodiment, if the landmark 1 is an overtime landmark with an overtime response, the anchor point 1 continues to perform network detection on the landmark 1, and after a plurality of times, determines whether the number of times of the overtime response of the landmark 1 exceeds a first preset number, where the first preset number is generally set to 15 times. If the timeout response is less than 15 times, landmark 1 may be affected by the network and cause a timeout, go to step 207; if the timeout is 15 times or more, go to step 208.
207. Determining the regional landmarks in the preset regional range where the overtime landmarks are located, calculating the average value of the detection time of the regional landmarks, replacing the average value with the detection time of the overtime landmarks and the corresponding anchor points, and obtaining time delay information between all anchor points and all landmarks;
in this embodiment, the preset area range may be specifically a city, and if the timeout response of landmark 1 is less than 15 times, it is determined that the area landmark is within the preset area range where the timeout landmark is located, for example, in the city of the timeout landmark (landmark 1), there are landmarks 2, 3, and 4, and then landmarks 2, 3, and 4 are area landmarks, the average value of the detection times of anchor point 1 and 2, landmark 3, and landmark 4 is calculated, the average value is replaced with the detection times of anchor point 1 and landmark 1, and the detection times corresponding to other landmarks which are not responded to overtime are not changed, so that the time delay information between all anchor points and all landmarks can be obtained.
208. Determining at least one router on a route tracking path between the overtime landmark and the corresponding anchor point by a route tracking technology;
in this embodiment, if landmark 1 responds with timeout 15 times or more, the router on the route tracking path between the timeout landmark 1 and the corresponding anchor point 1 may be determined by the route tracking technology, where the number of the routers is at least one, for example, as shown in fig. 4, there are n routers on the specific route tracking path.
209. Carrying out network detection on the router instead of the overtime landmarks to obtain time delay information between all anchor points and all landmarks;
in this embodiment, after a router is selected from the route tracking path to perform network probing with the anchor point 1 instead of the timeout landmark (landmark 1), the probing time is substituted for the probing time of the landmark 1 and the anchor point 1, and the probing time corresponding to other landmarks which are not responded to overtime is not changed, so that time delay information between all anchor points and all landmarks can be obtained.
210. Carrying out random forest training according to the time delay information to obtain an IP positioning model based on random forests;
refer to step 104 of the embodiment shown in FIG. 1 for details.
211. And inputting the IP address to be inquired into an IP positioning model based on a random forest to obtain the IP geographical position of the IP address to be inquired.
Please refer to step 105 of the embodiment shown in fig. 1 for details.
In the embodiment of the invention, when the network probing function is used, the quality of network probing is affected according to a series of reasons such as distance, network quality and the like, that is, a timeout response occurs to a part of landmarks. When the time-out mark does not exist, the processing is not needed; when the overtime landmark appears and the overtime response times do not exceed the preset times, the average value of the detection time of the regional landmark in the preset region range where the overtime landmark is located can be replaced by the detection time corresponding to the overtime landmark, so that the overtime problem of the overtime landmark is solved; when the overtime landmark appears and the overtime response times exceed the preset times, the router on the route tracking path between the overtime landmark and the corresponding anchor point can be used for network detection, and the detection time corresponding to the router is replaced by the detection time corresponding to the overtime landmark, so that the overtime problem of the overtime landmark is eliminated. Therefore, even if a series of reasons such as network quality affect the quality of network detection and cause the condition that part of landmarks are overtime, the overtime problem can be eliminated.
In the embodiment shown in fig. 2 above, in step 209, when the router replaces the timeout label, a similar timeout problem may also exist because the router is on the route tracking path of the timeout label and the anchor point, and the router may not have a network probing function, which is described in detail below by way of an embodiment.
Referring to fig. 5, an embodiment of the present invention provides an IP positioning method based on a random forest, including:
501. setting at least two detection servers as anchor points, wherein each anchor point has a corresponding IP address and an IP geographic position;
please refer to step 201 of the embodiment shown in fig. 2 for details.
502. Obtaining at least two landmarks by comparing at least two IP address databases, wherein each landmark has a corresponding IP address and an IP geographic position;
please refer to step 202 of the embodiment shown in fig. 2 for details.
503. Network detection is carried out between each anchor point and all landmarks, and detection time from all anchor points to all landmarks is obtained;
please refer to step 203 of the embodiment shown in fig. 2 for details.
504. Judging whether an overtime landmark responding overtime exists or not according to the detection time; if no timeout landmark exists, go to step 505; if yes, go to step 506;
refer to step 204 of the embodiment shown in FIG. 2 for details.
505. Obtaining time delay information between all anchor points and all landmarks according to the detection time;
please refer to step 205 of the embodiment shown in fig. 2 for details.
506. Judging whether the overtime response times of the overtime landmarks exceed a first preset time; if the number of times does not exceed the first preset number of times, go to step 507; if the number of times exceeds the first preset number of times, go to step 508;
please refer to step 206 of the embodiment shown in fig. 2 for details.
507. Determining the regional landmarks in the preset regional range where the overtime landmarks are located, calculating the average value of the detection time of the regional landmarks, replacing the average value with the detection time of the overtime landmarks and the corresponding anchor points, and obtaining time delay information between all anchor points and all landmarks;
please refer to step 207 of the embodiment shown in fig. 2 for details.
508. Determining at least one router on a route tracking path between the overtime landmark and the corresponding anchor point by a route tracking technology;
please refer to step 208 of the embodiment shown in fig. 2 for details.
509. Selecting a nearest one-hop router which is nearest to an anchor point on a route tracking path from routers, wherein the nearest one-hop router does not exceed a preset hop number from an overtime landmark;
in this embodiment, as shown in fig. 4, a router n closest to an anchor point 1 is selected from the routers 1 to n as a nearest one-hop router, and it should be noted that the router n generally does not exceed a preset hop count from an overtime landmark 1, and the preset hop count is generally set to 4 hops, because the exceeding of the hop count results in a reduction of a detection time, and there is no substitute significance.
510. Judging whether the nearest one-hop router and the anchor point can carry out network detection; if not, go to step 511; if so, go to step 512
In this embodiment, since the router may not have the network detection function, it needs to determine whether the nearest one-hop router and the anchor point 1 can perform network detection, and if not, execute step 511; if so, step 512 is performed.
511. Discarding the overtime landmarks to obtain time delay information between all anchor points and all landmarks except the overtime landmarks;
in this embodiment, if the last hop router and anchor point 1 are not capable of network probing, the timeout landmark (landmark 1) is discarded, i.e., the timeout landmark is deleted in the time delay information between all anchor points and all landmarks.
512. Carrying out network detection on the latest one-hop router instead of the overtime landmark and the corresponding anchor point to obtain the detection time of the router;
in this embodiment, if the nearest one-hop router and the anchor point 1 can perform network detection, the nearest one-hop router replaces the timeout landmark and the corresponding anchor point to perform network detection, so as to obtain the router detection time.
513. Judging whether an overtime response exists according to the detection time of the router; if there is no timeout response, go to step 514; if there is a timeout response, go to step 515;
514. replacing the detection time of the router with the detection time corresponding to the overtime landmarks to obtain time delay information between all anchor points and all landmarks;
in this embodiment, when there is no timeout response, the detection time of the router replaces the detection times of the landmark 1 and the anchor point 1, and the detection times corresponding to other landmarks which do not respond overtime are not changed, so that the time delay information between all anchor points and all landmarks can be obtained.
515. Judging whether the overtime response times of the router of the latest hop exceed a second preset time; if the second preset number of times is not exceeded, go to step 514; if the number of times exceeds the second preset number of times, step 511 is executed;
516. carrying out random forest training according to the time delay information to obtain an IP positioning model based on random forests;
please refer to step 210 of the embodiment shown in fig. 2 for details.
517. And inputting the IP address to be inquired into an IP positioning model based on a random forest to obtain the IP geographical position of the IP address to be inquired.
Please refer to step 211 of the embodiment shown in fig. 2 for details.
In the embodiment of the invention, on the route tracking path of the overtime landmark and the anchor point, the router selects the nearest one-hop router closest to the anchor point to be replaced by the overtime landmark, and the distance between the nearest one-hop router and the overtime landmark does not exceed the preset hop count, so that the overtime landmark is discarded when the condition that the nearest one-hop router does not have the network detection function is considered; after the nearest one-hop router and the anchor point carry out network detection, if no overtime response exists, the replacement is successful; if the overtime response exists, the replacement is successful when the overtime response times do not exceed the preset times; if the overtime response exists, the overtime landmark is discarded when the overtime response times exceed the preset times.
The IP positioning method based on random forest is specifically described in the above embodiment, and the IP positioning system based on random forest is described below through the embodiment.
Referring to fig. 6, an embodiment of the present invention provides an IP positioning system based on random forest, including:
an anchor setting module 601, a landmark obtaining module 602, a network detection module 603, a model training module 604 and a positioning module 605;
an anchor setting module 601, configured to set at least two detection servers as anchors, where each anchor has a corresponding IP address and IP geographic location;
a landmark obtaining module 602, configured to obtain at least two landmarks by comparing at least two IP address databases, where each landmark has a corresponding IP address and IP geographic location;
a network detection module 603, configured to perform network detection on all anchors and all landmarks, and obtain time delay information between all anchors and all landmarks;
the model training module 604 is configured to perform random forest training according to the time delay information to obtain an IP positioning model based on a random forest;
and the positioning module 605 is configured to input the IP address to be queried into an IP positioning model based on a random forest, so as to obtain an IP geographic location of the IP address to be queried.
Alternatively, in some embodiments of the present invention,
the network detection module 603 is specifically configured to perform network detection on each anchor point and all landmarks to obtain detection time from all anchor points to all landmarks;
the network detection module 603 is further configured to determine whether an overtime landmark responding overtime exists according to the detection time;
the network detection module 603 is further configured to, if no timeout landmark exists, obtain time delay information between all anchors and all landmarks according to the detection time;
the network detection module 603 is further configured to, if an overtime landmark exists, determine whether the number of times of overtime response of the overtime landmark exceeds a first preset number;
the network detection module 603 is further configured to determine a regional landmark within the preset region range where the overtime landmark is located if the number of times does not exceed the first preset number of times, calculate an average value of detection times of the regional landmark, and replace the average value with the detection times of the overtime landmark and a corresponding anchor point to obtain time delay information between all anchor points and all landmarks;
the network detection module 603 is further configured to determine, through a route tracking technology, at least one router on a route tracking path between the timeout landmark and the corresponding anchor point if the number of times exceeds the first preset number of times;
the network detection module 603 is further configured to perform network detection on the router instead of the overtime landmark, so as to obtain time delay information between all anchors and all landmarks.
Alternatively, in some embodiments of the present invention,
the network detection module 603 is further configured to select a nearest one-hop router closest to an anchor point on the route tracking path from the routers, where the nearest one-hop router does not exceed a preset hop count by a distance timeout landmark;
the network detection module 603 is further configured to determine whether the nearest one-hop router and the anchor point can perform network detection;
the network detection module 603 is further configured to discard the overtime landmark if the time delay information cannot be obtained, and obtain time delay information between all anchor points and all landmarks other than the overtime landmark;
the network detection module 603 is further configured to, if yes, perform network detection on the latest one-hop router instead of the timeout landmark and the corresponding anchor point, so as to obtain router detection time;
the network detection module 603 is further configured to determine whether an timeout response exists according to the router detection time;
the network detection module 603 is further configured to replace the detection time of the router with the detection time corresponding to the timeout landmark if no timeout response exists, so as to obtain time delay information between all anchors and all landmarks;
the network detection module 603 is further configured to determine whether the number of timeout responses of the last hop router exceeds a second preset number if the timeout responses exist;
the network detection module 603 is further configured to replace the detection time of the router with the detection time corresponding to the overtime landmark if the second preset number of times is not exceeded, so as to obtain time delay information between all anchor points and all landmarks;
the network detecting module 603 is further configured to discard the overtime landmark if the number of times exceeds the second preset number of times, so as to obtain time delay information between all anchor points and all landmarks except the overtime landmark.
Alternatively, in some embodiments of the present invention,
a landmark obtaining module 602, configured to specifically search at least two IP address databases to obtain at least two IP data sets, where each IP data set has the same number of IP data, and the IP data includes an IP address and an IP geographic location;
the landmark obtaining module 602 is further configured to compare all the IP data sets, and select consistent IP data with the same IP address and the same IP geographical location, where the consistent IP data includes at least two;
the landmark obtaining module 602 is further configured to obtain a landmark set according to the consistent IP data, and one landmark in the landmark set corresponds to one consistent IP data.
Alternatively, in some embodiments of the present invention,
the landmark obtaining module 602 is further configured to divide the landmark set into a landmark training set and a landmark testing set, where the landmark training set has N landmarks, N is a positive integer not less than 2, and the landmark testing set includes at least two testing landmarks.
Optionally, in some embodiments of the present invention, the number of anchor points is M, M is a positive integer not less than 2,
the model training module 604 is further configured to form an N × M feature matrix according to the M anchor points and the N landmarks in the landmark training set, where the feature matrix has M feature dimensions, and one feature dimension is time delay information between one anchor point and the N landmarks.
Alternatively, in some embodiments of the present invention,
the model training module 604 is further configured to use the time delay information between each anchor point and the N landmarks as a feature dimension to obtain M feature dimensions;
the model training module 604 is further configured to obtain an N × M feature matrix according to the M feature dimensions;
the model training module 604 is further configured to perform random forest training according to the N × M feature matrix, so as to obtain an IP positioning model based on a random forest.
Alternatively, in some embodiments of the present invention,
the model training module 604 is further configured to obtain test IP data of the landmark test centralized test landmarks, and analyze the test IP data to obtain a test IP address and a test IP geographic location;
the model training module 604 is further configured to input the test IP address into an IP positioning model based on a random forest, so as to obtain a positioning IP geographic location;
the model training module 604 is further configured to calculate a test accuracy according to the test IP geographical position and the positioning IP geographical position;
the model training module 604 is further configured to retrain the IP positioning model based on the random forest if the test accuracy does not reach the threshold;
the model training module 604 is further configured to, if the test accuracy reaches a threshold, retain the IP positioning model based on the random forest.
Optionally, in some embodiments of the present invention, the IP geographic location includes country, province, and city information; the preset area range of the overtime landmark is the city of the overtime landmark.
In the embodiment of the invention, an anchor setting module 601 sets at least two detection servers as anchors, each anchor has a corresponding IP address and an IP geographic position, a landmark obtaining module 602 obtains at least two landmarks by comparing at least two IP address databases, each landmark has a corresponding IP address and an IP geographic position, a network detection module 603 performs network detection between all anchors and all landmarks to obtain time delay information between all anchors and all landmarks, a model training module 604 performs random forest training according to the time delay information to obtain an IP positioning model based on a random forest, and a positioning module 605 inputs an IP address to be queried into the IP positioning model based on the random forest to obtain a target IP geographic position of the IP address to be queried. By utilizing the principle that time delay and distance are positively correlated, random forest training is carried out on the time delay information to obtain the IP positioning model based on the random forest by using the time delay information of each anchor point to the landmark, which is obtained by network detection of the anchor point and the landmark, and the IP geographic position can be positioned by the IP positioning model based on the random forest through the IP address to be inquired, so that the problem that the accuracy of an IP address database in the existing IP positioning is insufficient and the precision requirement of the safety field to the IP positioning can not be met is solved.
The foregoing is considered as illustrative of the preferred embodiments of the invention and is not to be construed as limiting the invention in any way. Although the present invention has been described with reference to the preferred embodiments, it is not intended to be limited thereto. Those skilled in the art can make numerous possible variations and modifications to the present invention, or modify equivalent embodiments to equivalent variations, without departing from the scope of the invention, using the teachings disclosed above. Therefore, any simple modification, equivalent change and modification made to the above embodiments according to the technical spirit of the present invention should fall within the protection scope of the technical scheme of the present invention, unless the technical spirit of the present invention departs from the content of the technical scheme of the present invention.
The previous description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other embodiments without departing from the spirit or scope of the invention. Thus, the present invention is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
Claims (9)
1. An IP positioning method based on random forest is characterized by comprising the following steps:
setting at least two detection servers as anchor points, wherein each anchor point has a corresponding IP address and an IP geographic position;
obtaining at least two landmarks by comparing at least two IP address databases, wherein each landmark has a corresponding IP address and an IP geographic position;
network detection is carried out between all anchor points and all landmarks, and time delay information between all anchor points and all landmarks is obtained;
performing random forest training according to the time delay information to obtain an IP positioning model based on a random forest;
inputting the IP address to be inquired into the IP positioning model based on the random forest to obtain the IP geographic position of the IP address to be inquired;
the network detection of all anchors and all landmarks to obtain the time delay information of all anchors and all landmarks includes:
network detection is carried out between each anchor point and all landmarks, and detection time from all anchor points to all landmarks is obtained;
judging whether an overtime landmark responding overtime exists or not according to the detection time;
if the overtime landmarks do not exist, obtaining time delay information between all anchor points and all landmarks according to the detection time;
if the overtime landmark exists, judging whether the overtime response times of the overtime landmark exceed a first preset time;
if the number of times of the first preset times is not exceeded, determining the regional landmarks in the preset region range where the overtime landmarks are located, calculating the average value of the detection time of the regional landmarks, replacing the average value with the detection time of the overtime landmarks and the corresponding anchor points, and obtaining time delay information between all anchor points and all landmarks;
if the number of times exceeds the first preset number of times, determining at least one router on a route tracking path between the overtime landmark and the corresponding anchor point through a route tracking technology;
and replacing the overtime landmarks with the router to carry out network detection to obtain time delay information between all anchor points and all landmarks.
2. The method of claim 1, wherein said performing network probing with the router instead of the timeout landmark to obtain time delay information between all anchors and all landmarks comprises:
selecting a nearest one-hop router which is nearest to an anchor point on the route tracking path from the routers, wherein the distance between the nearest one-hop router and the overtime landmark does not exceed a preset hop count;
judging whether the nearest one-hop router and the anchor point can carry out network detection;
if not, discarding the overtime landmark to obtain time delay information between all anchor points and all landmarks except the overtime landmark;
if yes, the nearest one-hop router replaces the overtime landmark and the corresponding anchor point to carry out network detection, and router detection time is obtained;
judging whether an overtime response exists according to the detection time of the router;
if the overtime response does not exist, replacing the detection time of the router with the detection time corresponding to the overtime landmark to obtain time delay information between all anchors and all landmarks;
if the overtime response exists, judging whether the overtime response times of the nearest hop router exceed a second preset time;
if the number of times does not exceed the second preset number of times, replacing the detection time of the router with the detection time corresponding to the overtime landmark to obtain time delay information between all anchor points and all landmarks;
if the number of times exceeds the second preset number, the overtime landmark is discarded, and the time delay information between all anchor points and all landmarks except the overtime landmark is obtained.
3. The method according to claim 1 or 2, wherein the obtaining at least two landmarks by comparing at least two IP address databases comprises:
searching at least two IP address databases to obtain at least two IP data sets, wherein each IP data set has the same number of IP data, and the IP data comprises IP addresses and IP geographic positions;
comparing all IP data sets, and selecting consistent IP data with the same IP address and the same IP geographical position, wherein the consistent IP data comprises at least two;
and obtaining a landmark set according to the consistent IP data, wherein one landmark in the landmark set corresponds to one consistent IP data.
4. The method of claim 3, further comprising:
dividing the landmark set into a landmark training set and a landmark testing set, wherein the landmark training set is provided with N landmarks, N is a positive integer not less than 2, and the landmark testing set comprises at least two testing landmarks.
5. The method of claim 4, wherein the number of anchor points is M, wherein M is a positive integer not less than 2,
before the random forest training is performed according to the time delay information to obtain an IP positioning model based on a random forest, the method further comprises the following steps:
and forming an N x M feature matrix according to the M anchor points and the N landmarks in the landmark training set, wherein the feature matrix has M feature dimensions, and one feature dimension is time delay information between one anchor point and the N landmarks.
6. The method as claimed in claim 5, wherein said performing random forest training according to said time delay information to obtain a random forest based IP positioning model comprises:
taking the time delay information between each anchor point and the N landmarks as a characteristic dimension to obtain M characteristic dimensions;
obtaining a feature matrix of N x M according to the M feature dimensions;
and carrying out random forest training according to the N-M characteristic matrix to obtain an IP positioning model based on a random forest.
7. The method as claimed in claim 6, wherein after the random forest training is performed according to the N x M feature matrix, and an IP positioning model based on a random forest is obtained, the method further comprises:
acquiring test IP data of the landmark test centralized test landmark, and analyzing the test IP data to obtain a test IP address and a test IP geographical position;
inputting the test IP address into the IP positioning model based on the random forest to obtain a positioning IP geographical position;
counting the test accuracy according to the test IP geographical position and the positioning IP geographical position;
if the testing accuracy does not reach a threshold value, retraining the IP positioning model based on the random forest;
and if the testing accuracy reaches a threshold value, reserving the IP positioning model based on the random forest.
8. The method of claim 1,
the IP geographical position comprises national, provincial and urban information;
the preset area range of the overtime landmark is the city of the overtime landmark.
9. An IP positioning system based on random forests, comprising:
anchor point setting module, landmark obtaining module, network detection module, model training module and positioning module
The anchor setting module performing the method of any of claims 1-8 above sets at least two probe servers as anchors, each anchor having a corresponding IP address and IP geographic location;
the landmark acquisition module performs the method of any one of claims 1-8 above to acquire at least two landmarks, each landmark having a corresponding IP address and IP geographic location;
the network detection module performs the method of any one of claims 1-8 above to detect time delay information between all anchors and all landmarks;
the model training module executes the method of any one of the preceding claims 1-8 to train to obtain an IP positioning model based on a random forest;
the positioning module executes the method of any one of the preceding claims 1-8 to obtain the IP geographical position of the IP address to be queried through the random forest based IP positioning model.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011424851.0A CN112215358B (en) | 2020-12-09 | 2020-12-09 | IP positioning method and system based on random forest |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011424851.0A CN112215358B (en) | 2020-12-09 | 2020-12-09 | IP positioning method and system based on random forest |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112215358A CN112215358A (en) | 2021-01-12 |
| CN112215358B true CN112215358B (en) | 2021-03-05 |
Family
ID=74068160
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011424851.0A Active CN112215358B (en) | 2020-12-09 | 2020-12-09 | IP positioning method and system based on random forest |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112215358B (en) |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109858508A (en) * | 2018-10-23 | 2019-06-07 | 重庆邮电大学 | IP localization method based on Bayes and deep neural network |
| CN110012120A (en) * | 2019-03-14 | 2019-07-12 | 罗向阳 | A kind of IP City-level location algorithm based on PoP network topology |
| CN111711707A (en) * | 2020-04-30 | 2020-09-25 | 国家计算机网络与信息安全管理中心江苏分中心 | IP address positioning method based on neighbor relation |
| CN111753664A (en) * | 2020-05-25 | 2020-10-09 | 西南石油大学 | Suspect identification and positioning tracking system and method based on 5G wireless network |
| CN111818198A (en) * | 2020-09-10 | 2020-10-23 | 腾讯科技（深圳）有限公司 | Domain name detection method, domain name detection device, equipment and medium |
Family Cites Families (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CA2780206C (en) * | 2009-11-10 | 2018-05-01 | Telefonaktiebolaget Lm Ericsson (Publ) | Handover delay optimization |
| CA3099659A1 (en) * | 2018-05-07 | 2019-11-14 | Strong Force Iot Portfolio 2016, Llc | Methods and systems for data collection, learning, and streaming of machine signals for analytics and maintenance using the industrial internet of things |
| CN110474843B (en) * | 2019-07-03 | 2021-07-06 | 上海交通大学 | IP positioning method based on route hop count |
| CN110912756B (en) * | 2019-12-13 | 2022-03-08 | 中国人民解放军战略支援部队信息工程大学 | IP positioning-oriented network topology boundary routing IP identification algorithm |
-
2020
- 2020-12-09 CN CN202011424851.0A patent/CN112215358B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109858508A (en) * | 2018-10-23 | 2019-06-07 | 重庆邮电大学 | IP localization method based on Bayes and deep neural network |
| CN110012120A (en) * | 2019-03-14 | 2019-07-12 | 罗向阳 | A kind of IP City-level location algorithm based on PoP network topology |
| CN111711707A (en) * | 2020-04-30 | 2020-09-25 | 国家计算机网络与信息安全管理中心江苏分中心 | IP address positioning method based on neighbor relation |
| CN111753664A (en) * | 2020-05-25 | 2020-10-09 | 西南石油大学 | Suspect identification and positioning tracking system and method based on 5G wireless network |
| CN111818198A (en) * | 2020-09-10 | 2020-10-23 | 腾讯科技（深圳）有限公司 | Domain name detection method, domain name detection device, equipment and medium |
Non-Patent Citations (1)
| Title |
|---|
| 基于随机森林的IP城市级定位方法研究;雷雨晴;《中国优秀硕士学位论文全文数据库 信息科技辑》;20201015(第10期);第I139-29页 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112215358A (en) | 2021-01-12 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN102307123B (en) | NAT (Network Address Translation) flow identification method based on transmission layer flow characteristic | |
| CN110336789A (en) | Domain-flux Botnet detection method based on blended learning | |
| CN104899243A (en) | Method and apparatus for detecting accuracy of POI (Point of Interest) data | |
| CN107046586A (en) | A kind of algorithm generation domain name detection method based on natural language feature | |
| CN107145779B (en) | Method and device for identifying offline malicious software log | |
| CN107368480B (en) | Method and device for locating and repeatedly identifying error types of point of interest data | |
| CN109842588A (en) | Network data detection method and relevant device | |
| CN114374626B (en) | Router performance detection method under 5G network condition | |
| CN110995885A (en) | IP positioning method based on router error training | |
| CN110912756B (en) | IP positioning-oriented network topology boundary routing IP identification algorithm | |
| CN111064817B (en) | City-level IP positioning method based on node sorting | |
| Li et al. | Street-Level Landmarks Acquisition Based on SVM Classifiers. | |
| CN108055227B (en) | WAF unknown attack defense method based on site self-learning | |
| Liu et al. | RNBG: a ranking nodes based IP geolocation method | |
| CN112215358B (en) | IP positioning method and system based on random forest | |
| Gharaibeh et al. | Assessing co-locality of IP blocks | |
| CN110012128A (en) | Network entity terrestrial reference screening technique based on hop count | |
| Chandrasekaran et al. | Alidade: Ip geolocation without active probing | |
| CN110730128A (en) | Information propagation path processing method and device, electronic equipment and storage medium | |
| Zhao et al. | Improving IP geolocation databases based on multi-method classification | |
| CN109218184B (en) | Router attribution AS identification method based on port and structure information | |
| Li et al. | A complete evaluation of the Chinese IP geolocation databases | |
| CN105812204A (en) | Recursion domain name server online identification method based on connectivity estimation | |
| CN114880587A (en) | Port scanning path recommendation method for Internet of things equipment | |
| CN111079044B (en) | Sharing detection method and device |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |