CN113923184B

CN113923184B - IP positioning reference point extraction method, device and readable storage medium

Info

Publication number: CN113923184B
Application number: CN202111047197.0A
Authority: CN
Inventors: 吕博; 王远辉; 王蕊; 姚琳元
Original assignee: China Academy of Electronic and Information Technology of CETC
Current assignee: China Academy of Electronic and Information Technology of CETC
Priority date: 2021-09-07
Filing date: 2021-09-07
Publication date: 2023-06-20
Anticipated expiration: 2041-09-07
Also published as: CN113923184A

Abstract

The invention discloses a method and a device for extracting an IP positioning reference point and a readable storage medium, wherein the method comprises the steps of obtaining network traffic; filtering the network traffic to preserve traffic data of a target protocol; determining an IP address of a reference point based on traffic data of the target protocol; determining position information corresponding to the network traffic based on the IP address of the reference point; a reference point library is established based on the determined location information. The embodiment of the invention filters the network flow to reserve the flow data of the target protocol, determines the IP address of the datum point based on the flow data of the target protocol, thereby extracting the position information and establishing the datum point library.

Description

IP positioning reference point extraction method, device and readable storage medium

Technical Field

The present invention relates to the field of positioning technologies, and in particular, to a method and apparatus for extracting an IP positioning reference point, and a readable storage medium.

Background

IP positioning is a network measurement taken to determine the geographic location of an IP device, and is widely used in geographic location-based network applications, such as malicious behavior tracing, targeted advertising, social networking, network security, performance optimization, and the like.

The basic principle of IP positioning is to estimate the geographic location of an IP device by using the name, registration information, or delay information of the IP device. The basic principle of the positioning algorithm design is as follows: on the premise of ensuring positioning accuracy, the method reduces the measurement overhead as much as possible, has good expansibility and can protect user privacy.

The conventional IP address location algorithm estimates the host location according to the linear relationship between the time delay and the geographic distance, and reduces the location error by topology information. Traditional reference point information is mainly obtained through web page crawling, purchasing of operator IP address allocation data, whois information extraction and the like, but because of the changeable internet topology, the accuracy and the reliability of the acquired or purchased reference point information are low, and the requirement of IP positioning cannot be met.

Disclosure of Invention

The embodiment of the invention provides an IP positioning reference point extraction method, an IP positioning reference point extraction device and a readable storage medium, which are used for obtaining high-quality, high-precision and high-reliability reference point information by utilizing a passive flow extraction method to form a reference point library and providing reference point information support for IP address position measurement.

In a first aspect, an embodiment of the present invention provides a method for extracting an IP positioning reference point, including:

acquiring network traffic;

filtering the network traffic to preserve traffic data of a target protocol;

determining an IP address of a reference point based on traffic data of the target protocol;

determining position information corresponding to the network traffic based on the IP address of the reference point;

a reference point library is established based on the determined location information.

In some embodiments, determining the IP address of the reference point based on the traffic data of the target protocol specifically includes

And extracting a source IP address from quintuple information of the flow data of the target protocol as an IP address of a reference point.

In some embodiments, filtering the network traffic and retaining traffic data of the HTTP protocol is also included.

In some embodiments, determining location information corresponding to the network traffic based on the IP address of the reference point comprises:

determining longitude and latitude information through regular expression matching in a POST request or a GET request based on the flow data of the HTTP;

and determining the position information corresponding to the network traffic based on the longitude and latitude information.

In some embodiments, determining longitude and latitude information by regular expression matching in a POST request or a GET request based on traffic data of the HTTP protocol includes:

in the case that the POST request or GET request contains a target field or a target character related to the latitude and longitude information, the latitude and longitude information is determined based on the target field or the target character.

In some embodiments, building a benchmark library based on benchmark fusion information determined by other channels is also included.

In some embodiments, the fiducial determined for the other channel is determined from fiducial data for the other channel.

The embodiment of the invention also provides an IP positioning reference point extraction system, which comprises a processor configured to:

acquiring network traffic;

filtering the network traffic to preserve traffic data of a target protocol;

The embodiment of the invention also provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program realizes the steps of the IP positioning reference point extraction method when being executed by a processor.

The embodiment of the invention filters the network flow to reserve the flow data of the target protocol, determines the IP address of the datum point based on the flow data of the target protocol, thereby extracting the position information and establishing the datum point library.

The foregoing description is only an overview of the present invention, and is intended to be implemented in accordance with the teachings of the present invention in order that the same may be more clearly understood and to make the same and other objects, features and advantages of the present invention more readily apparent.

Drawings

Various other advantages and benefits will become apparent to those of ordinary skill in the art upon reading the following detailed description of the preferred embodiments. The drawings are only for purposes of illustrating the preferred embodiments and are not to be construed as limiting the invention. Also, like reference numerals are used to designate like parts throughout the figures. In the drawings:

FIG. 1 is a basic flow chart of a method of an embodiment of the present disclosure;

fig. 2 is a sub-flowchart of a method of an embodiment of the present disclosure.

Detailed Description

Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

It should be understood that various modifications may be made to the embodiments of the application herein. Therefore, the above description should not be taken as limiting, but merely as exemplification of the embodiments. Other modifications within the scope and spirit of this disclosure will occur to persons of ordinary skill in the art.

The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments of the disclosure and, together with a general description of the disclosure given above and the detailed description of the embodiments given below, serve to explain the principles of the disclosure.

These and other characteristics of the present disclosure will become apparent from the following description of a preferred form of embodiment, given as a non-limiting example, with reference to the accompanying drawings.

It is also to be understood that, although the disclosure has been described with reference to some specific examples, a person skilled in the art will certainly be able to achieve many other equivalent forms of the disclosure, having the characteristics as set forth in the claims and hence all coming within the field of protection defined thereby.

The above and other aspects, features and advantages of the present disclosure will become more apparent in light of the following detailed description when taken in conjunction with the accompanying drawings.

Specific embodiments of the present disclosure will be described hereinafter with reference to the accompanying drawings; however, it is to be understood that the disclosed embodiments are merely examples of the disclosure, which may be embodied in various forms. Well-known and/or repeated functions and constructions are not described in detail to avoid obscuring the disclosure in unnecessary or unnecessary detail. Therefore, specific structural and functional details disclosed herein are not intended to be limiting, but merely serve as a basis for the claims and as a representative basis for teaching one skilled in the art to variously employ the present disclosure in virtually any appropriately detailed structure.

The specification may use the word "in one embodiment," "in another embodiment," "in yet another embodiment," or "in other embodiments," which may each refer to one or more of the same or different embodiments in accordance with the disclosure.

An embodiment of the present invention provides a method for extracting an IP positioning reference point, as shown in fig. 1, including:

s101, acquiring network traffic;

illustratively, the original network traffic of a certain egress router may be obtained by traffic mirroring, traffic splitting, and the like.

S102, filtering the network traffic to reserve traffic data of a target protocol;

traffic for which IP geographic location information is unlikely or of small probability may be filtered in this example. Traffic filtering may preserve HTTP traffic, filtering out other protocol traffic. Among internet traffic, the HTTP protocol has the greatest possibility of including geographic location information, mainly because a large number of internet applications based on geographic location information need to send latitude and longitude coordinate information of a user to an application server in the form of a request for processing, such as a surrounding recommendation service, a map service, and the like. The longitude and latitude coordinates in the traffic are usually real-time longitude and latitude information acquired by a GPS sensor of the application terminal, and the IP address in the traffic is usually the real IP address of the user, so that the positioning accuracy and the reliability are higher. For example, the network traffic may be filtered and traffic data of the HTTP protocol may be retained in some embodiments. Since analyzing the flow and finding the reference point need to consume a lot of calculation resources, the original flow is filtered in this example, so that the consumption of calculation resources can be greatly reduced, and the calculation efficiency is improved.

S103, determining the IP address of the datum point based on the flow data of the target protocol.

The filtered flow data of the HTTP protocol can be used for determining the IP address of the datum point.

Finally, S104 may determine location information corresponding to the network traffic based on the IP address of the reference point, and in step S105, a reference point library may be established based on the determined location information.

In some embodiments, determining the IP address of the reference point based on the traffic data of the target protocol specifically includes: and extracting a source IP address from quintuple information of the flow data of the target protocol as an IP address of a reference point. For example, the source IP address may be extracted from quintuple information of traffic data of the HTTP protocol as the IP address of the reference point.

In some embodiments, determining location information corresponding to the network traffic based on the IP address of the reference point comprises: determining longitude and latitude information through regular expression matching in a POST request or a GET request based on the flow data of the HTTP; and determining the position information corresponding to the network traffic based on the longitude and latitude information. In some embodiments, determining longitude and latitude information by regular expression matching in a POST request or a GET request based on traffic data of the HTTP protocol includes: in the case that the POST request or GET request contains a target field or a target character related to the latitude and longitude information, the latitude and longitude information is determined based on the target field or the target character. For example, the network application based on the geographic position information can transmit the geographic position information of the user terminal to the application server in a clear text manner through a POST or GET method of HTTP, and the longitude and latitude information can be found in the POST or GET request through a regular expression matching means. Since the coding mode of the request depends on naming habits of application service developers, all longitude and latitude information is not identified by general trial rules, and the method of the embodiment provides the following solutions:

condition one, occurrence of longitude and latitude keywords

When fields such as "longitude=" and "latitudide=" appear in the POST or GET request, the geographical location information can be found by matching the keyword and the following numerical values. Similar keywords are also "lon=" and "lat=" etc.

Case two, number meeting the condition

No keywords may be present in the POST or GET request, but numbers that meet latitude and longitude conditions are present, such as "x= 113.18" and "y=26.98". When two groups of numbers are simultaneously appeared in the context and are between-180 and 180, the numbers are extracted as longitude and latitude information.

Finally, the datum point information can be put in storage, for example, the identified IP address information and longitude and latitude information can be written into a database to be used as datum point data.

In some embodiments, building a benchmark library based on benchmark fusion information determined by other channels is also included. In some embodiments, the fiducial determined for the other channel is determined from fiducial data for the other channel. The reference point database obtained by passive flow is limited in size, so as to supplement the construction of the reference point database, as shown in fig. 2, the reference point database can be fused with reference point data obtained from other channels. And then, performing IP address positioning measurement, using the datum point to initiate a measurement task by the IP address positioning system, estimating the real geographic position of the IP address, and writing the geographic position into an IP geographic position information base.

Compared with the prior art, the method provided by the invention acquires the datum point information with high quality, high precision and high credibility, forms the datum point library, and provides the datum point information support for the IP address position measurement. The method filters the original flow, and filters the flow with impossible or small probability of occurrence of the IP geographic position information, only reserves the flow with the possible occurrence of the geographic position information, and avoids a large amount of calculation resources which are consumed for flow analysis and reference point discovery. The method can utilize less calculation resources to achieve more efficient technical results.

The embodiment of the invention also provides an IP positioning reference point extraction system, which comprises a processor configured to: acquiring network traffic; filtering the network traffic to preserve traffic data of a target protocol; determining an IP address of a reference point based on traffic data of the target protocol; determining position information corresponding to the network traffic based on the IP address of the reference point; a reference point library is established based on the determined frontal position information.

It should be noted that, in this document, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one … …" does not exclude the presence of other like elements in a process, method, article, or apparatus that comprises the element.

The foregoing embodiment numbers of the present invention are merely for the purpose of description, and do not represent the advantages or disadvantages of the embodiments.

From the above description of the embodiments, it will be clear to those skilled in the art that the above-described embodiment method may be implemented by means of software plus a necessary general hardware platform, but of course may also be implemented by means of hardware, but in many cases the former is a preferred embodiment. Based on such understanding, the technical solution of the present invention may be embodied essentially or in a part contributing to the prior art in the form of a software product stored in a storage medium (e.g. ROM/RAM, magnetic disk, optical disk) comprising instructions for causing a terminal (which may be a mobile phone, a computer, a server or a network device, etc.) to perform the method according to the embodiments of the present invention.

The embodiments of the present invention have been described above with reference to the accompanying drawings, but the present invention is not limited to the above-described embodiments, which are merely illustrative and not restrictive, and many forms may be made by those having ordinary skill in the art without departing from the spirit of the present invention and the scope of the claims, which are to be protected by the present invention.

Claims

1. An IP positioning reference point extraction method, comprising:

acquiring network traffic;

filtering the network traffic to preserve traffic data of a target protocol;

establishing a reference point library based on the determined amount position information;

the method also comprises the steps of filtering the network traffic and reserving traffic data of the HTTP protocol;

determining location information corresponding to the network traffic based on the IP address of the reference point includes:

determining position information corresponding to the network traffic based on the longitude and latitude information;

determining longitude and latitude information through regular expression matching in a POST request or a GET request based on the traffic data of the HTTP protocol includes:

determining longitude and latitude information based on a target field or a target character related to the longitude and latitude information when the POST request or the GET request contains the target field or the target character, wherein:

when the fields of 'longitude=' and 'latitudide=' appear in the POST or GET request, determining geographic location information by matching keywords and subsequent values;

no keyword appears in the POST or GET request, but numbers conforming to longitude and latitude conditions appear, and the numbers are between-180 and 180, and the numbers are extracted as longitude and latitude information;

further comprising building a benchmark library based on benchmark fusion information determined by other channels.

2. The IP positioning reference point extraction method of claim 1 wherein determining the IP address of the reference point based on the traffic data of the target protocol specifically comprises

3. The IP positioning reference point extraction method of claim 1, wherein the reference points determined by the other channels are determined based on reference point data of the other channels.

4. An IP positioning reference point extraction system comprising a processor configured to:

acquiring network traffic;

filtering the network traffic to preserve traffic data of a target protocol;

5. A computer-readable storage medium, wherein a computer program is stored on the computer-readable storage medium, which when executed by a processor, implements the steps of the IP positioning reference point extraction method of any one of claims 1 to 3.