CN114785719A - IP region attribution method for forming region fingerprint through ping command - Google Patents
IP region attribution method for forming region fingerprint through ping command Download PDFInfo
- Publication number
- CN114785719A CN114785719A CN202210380585.9A CN202210380585A CN114785719A CN 114785719 A CN114785719 A CN 114785719A CN 202210380585 A CN202210380585 A CN 202210380585A CN 114785719 A CN114785719 A CN 114785719A
- Authority
- CN
- China
- Prior art keywords
- region
- fingerprint
- detection
- address
- detection point
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 title claims abstract description 18
- 238000001514 detection method Methods 0.000 claims abstract description 95
- 238000004458 analytical method Methods 0.000 claims abstract description 10
- 238000012360 testing method Methods 0.000 claims description 11
- 239000000523 sample Substances 0.000 claims description 2
- 238000005259 measurement Methods 0.000 claims 3
- 238000002372 labelling Methods 0.000 abstract description 4
- 238000012545 processing Methods 0.000 abstract description 3
- 238000013500 data storage Methods 0.000 abstract description 2
- 238000007405 data analysis Methods 0.000 abstract 1
- 238000012937 correction Methods 0.000 description 2
- 238000003064 k means clustering Methods 0.000 description 2
- 238000004891 communication Methods 0.000 description 1
- 230000007547 defect Effects 0.000 description 1
- 238000011156 evaluation Methods 0.000 description 1
- 238000012423 maintenance Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/10—Active monitoring, e.g. heartbeat, ping or trace-route
Landscapes
- Health & Medical Sciences (AREA)
- Cardiology (AREA)
- General Health & Medical Sciences (AREA)
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Collating Specific Patterns (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses an IP region attribution method for forming a region fingerprint through a ping command, which relates to the technical field of information and comprises the following steps: 1) establishing detection points by regions; 2) collecting public network IP addresses by regions; 3) eliminating the tested IP address with wrong region number and updating the region IP address table; 4) obtaining ping command fingerprint characteristic curves by regions; 5) establishing a fingerprint curve matching analysis model; the method does not need huge IP address labeling information, avoids large-scale data processing, large data cluster requirements and data storage burden, has high timeliness of data analysis, reduces the manual labeling burden of large-scale IP data in an applicable scene, and can be suitable for quick area positioning of ipv6 addresses.
Description
Technical Field
The invention relates to the technical field of information.
Background
The ping command is a command under Windows, Unix, and Linux systems. ping also belongs to a communication protocol and is part of TCP, IP protocol. Whether the network is connected or not can be checked by utilizing the ping command, and the analysis and the judgment of the network fault can be well assisted.
The existing IP region judgment mainly depends on BGP border gateway protocol, AS autonomous system information and whois data acquisition applied by China Internet center, and then supplementary correction is carried out through routing tracking instruction and ping command data, wherein the supplementary correction comprises a large number of manual parts. Part of IP region judgment work has an automatic processing component, but the acquired data is still non-objective data because the previous data increases some error probability, and the data has great maintenance cost. whois is a database used to query details of domain names that have been registered.
The K-means clustering algorithm is also called as a K-means clustering algorithm, and is a distance-based clustering algorithm integrating simplicity and classics. The distance is used as an evaluation index of similarity, namely the closer the distance between two objects is, the greater the similarity of the two objects is. The algorithm considers that class clusters are composed of closely spaced objects, and therefore the resulting compact and independent clusters are the final target.
Disclosure of Invention
In view of the defects of the prior art, the IP zone attribution method for forming the zone fingerprint through the ping command provided by the invention comprises the following steps: 1) establishing detection points by regions; 2) collecting public network IP addresses by regions; 3) eliminating the tested IP address with wrong region number and updating the region IP address table; 4) obtaining ping command fingerprint characteristic curves by regions; 5) establishing a fingerprint curve matching analysis model;
1) regional establishment of detection points
The method comprises the steps that a detection point has an independent public network IP address, a server deployed by the detection point is used for carrying out ping command dial testing on a tested IP address in a region IP address table according to the region IP address table and generating dial testing numbers, and the dial testing numbers are composed of region numbers and the tested IP address;
secondly, recording delay time in information returned by the ping command when the server deployed by the detection point dials the detected IP address, and taking a median of the returned delay time and recording the median as the detected IP delay time of the detection point;
2) regional collection of public network IP addresses
The method comprises the steps of collecting 10000 IP addresses to be tested in each region and obtaining the IP addresses through public resources;
the tested IP address table distinguished by the region numbers is formed and is called as a region IP address table:
3) eliminating the tested IP address with wrong region number and updating the region IP address table
The method comprises the steps of using a clustering algorithm for detected IP delay time of detection points recorded by 10000 detected IP addresses of each region of detection point dial test, eliminating outlier detected IP delay time and corresponding detected IP addresses thereof, and updating a region IP address table;
4) obtaining ping command fingerprint characteristic curve by regions
Calculating the mean value of the measured IP delay time of the detection points of the same region which are not clustered under a clustering algorithm at the same detection point, recording the mean value as a fingerprint value of the detection point dial-measuring region, and recording the detection point number and the dial-measuring region number when the fingerprint value of the detection point dial-measuring region is recorded;
secondly, calculating the range of the measured IP delay time of the detection points of the same region which are not clustered under the clustering algorithm at the same detection point, recording the threshold value of the fingerprint value of the region dialed by the detection point, and recording the detection point number and the region dialed number when the threshold value of the fingerprint value of the region dialed by the detection point is recorded;
thirdly, dialing the fingerprint values of the regions according to the detection points recorded by all the detection points in the dialing detection region number set, forming a curve with the horizontal axis as the detection point number and the vertical axis as the detection point dialing detection region fingerprint value, and using the curve as a ping command fingerprint characteristic curve;
fourthly, threshold values of fingerprint values of the regions are dialed according to the probing points recorded by all the probing points in the set region number, a curve with the horizontal axis as the probing point number and the vertical axis as the probing point threshold values of the fingerprint values of the regions is formed, and the curve is used as a threshold value curve of a ping command fingerprint characteristic curve;
5) establishing fingerprint curve matching analysis model
Defining Cx as a difference average level of detected IP delay time of a detection point;
ri is a fingerprint value of a region which is dialed and measured by a certain detection point in a designated region;
ri is the detected IP delay time of the detection point of the IP address detected at the time;
n is the total number of the detection points;
secondly, defining the matching rate of the curve obtained by the detected IP address and the fingerprint characteristic curve of the ping command close to Px: px = 1-Cx;
thirdly, analyzing the consistency of curve curvature change, and setting de as average difference delay;
ce is the difference fluctuation level of the detected IP delay time, and di is the detected IP delay time difference of the current detection;
pe is the fluctuation matching level of the delay time length of the curve obtained by the IP address to be detected, and Pe = 1-Ce;
since Pv is a value that matches the ping command fingerprint characteristic curve in a single probe for a certain IP,
and fifthly, taking the region corresponding to the ping command fingerprint characteristic curve with the maximum Pv value as the region of the IP address to be tested.
Advantageous effects
The method does not need huge IP address labeling information, avoids large-scale data processing, large data cluster requirements and data storage burden, has high timeliness of analyzing data, reduces the manual labeling burden of large-scale IP data in an applicable scene, and can be suitable for rapid area positioning of ipv6 addresses.
Drawings
FIG. 1 is a flow chart of the present invention.
Detailed Description
Example one
Referring to fig. 1, the IP zone attribution method for forming a zone fingerprint by ping command according to the present invention comprises the following steps: s01, establishing detection points by regions; s02 collecting public IP address by regions; s03, eliminating the tested IP address with wrong region number, and updating the region IP address table; s04, obtaining ping command fingerprint characteristic curves by regions; s05, establishing a fingerprint curve matching analysis model;
s01 regional establishing detection point
The method comprises the steps that a detection point has an independent public network IP address, a server deployed by the detection point is used for carrying out ping command dial testing on a tested IP address in a region IP address table according to the region IP address table and generating dial testing numbers, and the dial testing numbers are composed of region numbers and the tested IP address;
secondly, recording delay time in information returned by the ping command when the server deployed by the detection point dials the detected IP address, and taking a median of the returned delay time and recording the median as the detected IP delay time of the detection point;
s02 regional collection of public network IP address
The method includes the steps that 10000 tested IP addresses are collected in each region and are obtained through public resources;
the tested IP address table distinguished by the region numbers is formed and is called as a region IP address table:
s03 eliminating the tested IP address with wrong region number and updating the region IP address table
The method comprises the steps of using a clustering algorithm for detected IP delay time of detection points recorded by 10000 detected IP addresses of each region of detection point dial test, eliminating outlier detected IP delay time and corresponding detected IP addresses thereof, and updating a region IP address table;
s04 obtaining ping command fingerprint characteristic curve by regions
Calculating the mean value of the measured IP delay time of the detection points of the same region which are not clustered under a clustering algorithm at the same detection point, recording the mean value as a fingerprint value of the detection point dial-measuring region, and recording the detection point number and the dial-measuring region number when the fingerprint value of the detection point dial-measuring region is recorded;
secondly, calculating the range of the measured IP delay time of the detection points of the same region which are not clustered under the clustering algorithm at the same detection point, recording the threshold value of the fingerprint value of the region dialed by the detection point, and recording the detection point number and the region dialed number when the threshold value of the fingerprint value of the region dialed by the detection point is recorded;
thirdly, dialing the fingerprint values of the regions according to the detection points recorded by all the detection points in the dialing detection region number set, forming a curve with the horizontal axis as the detection point number and the vertical axis as the detection point dialing detection region fingerprint value, and using the curve as a ping command fingerprint characteristic curve;
fourthly, threshold values of fingerprint values of the regions are dialed according to the probing points recorded by all the probing points in the set region number, a curve with the horizontal axis as the probing point number and the vertical axis as the probing point threshold values of the fingerprint values of the regions is formed, and the curve is used as a threshold value curve of a ping command fingerprint characteristic curve;
s05 establishing fingerprint curve matching analysis model
Defining Cx as a difference average level of detected IP delay time of a detection point;
ri is a fingerprint value of a certain detection point in a designated region;
ri is the detected IP delay time of the detection point for detecting the IP address at the time;
n is the total number of the detection points;
secondly, defining the matching rate of the curve obtained by the Px for the detected IP address and the fingerprint characteristic curve of the ping command close to each other: px = 1-Cx;
performing curve curvature change consistency analysis, and setting de as average difference delay;
ce is the difference fluctuation level of the detected IP delay time, and di is the detected IP delay time difference of the current detection;
pe is the fluctuation matching level of the delay time length of the curve obtained by the IP address to be detected, and Pe = 1-Ce;
pv is the value that a certain IP matches the ping command fingerprint characteristic curve in one detection,
the region corresponding to the ping command fingerprint characteristic curve with the maximum Pv value is the region of the IP address to be tested.
Claims (1)
1. The IP region attribution method for forming the region fingerprint through the ping command is characterized by comprising the following steps of: 1) establishing detection points by regions; 2) collecting public network IP addresses by regions; 3) eliminating the tested IP address with wrong region number and updating the region IP address table; 4) obtaining ping command fingerprint characteristic curves by regions; 5) establishing a fingerprint curve matching analysis model;
1) regional establishment of probe points
The method comprises the steps that a detection point has an independent public network IP address, a server deployed by the detection point is used for carrying out ping command dial testing on a tested IP address in a region IP address table according to the region IP address table and generating dial testing numbers, and the dial testing numbers are composed of region numbers and the tested IP address;
secondly, recording delay time in information returned by the ping command when the server deployed by the detection point dials the detected IP address, and taking a median of the returned delay time and recording the median as the detected IP delay time of the detection point;
2) regional collection of public network IP addresses
The method comprises the steps of collecting 10000 tested IP addresses in each region;
the tested IP address table distinguished by the region numbers is formed and is called as a region IP address table:
3) eliminating the tested IP address with wrong region number and updating the region IP address table
The method comprises the steps of using a clustering algorithm for detected IP delay time of detection points recorded by 10000 detected IP addresses of each region subjected to detection point dial detection, eliminating the detected IP delay time of outliers and the corresponding detected IP addresses, and updating a region IP address table;
4) obtaining ping command fingerprint characteristic curve by regions
Calculating the mean value of the measured IP delay time of detection points of the same region which are not clustered under a clustering method at the same detection point, recording the mean value as a fingerprint value of the detection point in a shift measurement region, and recording the detection point number and the shift measurement region number when the fingerprint value of the detection point in the shift measurement region is recorded;
secondly, calculating the range of the measured IP delay time of the detection points of the same region which are not clustered under the clustering algorithm at the same detection point, recording the threshold value of the fingerprint value of the region dialed by the detection point, and recording the detection point number and the region dialed number when the threshold value of the fingerprint value of the region dialed by the detection point is recorded;
thirdly, dialing the fingerprint values of the regions according to the detection points recorded by all the detection points in the dialing detection region number set, forming a curve with the horizontal axis as the detection point number and the vertical axis as the detection point dialing detection region fingerprint value, and using the curve as a ping command fingerprint characteristic curve;
fourthly, setting threshold values of fingerprint values of the regions according to the detection points recorded by all the detection points in the set detection region serial numbers, forming a curve with the horizontal axis as the detection point serial numbers and the vertical axis as the detection points, and setting the curve as a threshold value curve of a ping command fingerprint characteristic curve;
5) establishing fingerprint curve matching analysis model
Defining Cx as a difference average level of detected IP delay time of a detection point;
ri is a fingerprint value of a region which is dialed and measured by a certain detection point in a designated region;
ri is the detected IP delay time of the detection point for detecting the IP address at the time;
n is the total number of the detection points;
secondly, defining the matching rate of the curve obtained by the detected IP address and the fingerprint characteristic curve of the ping command close to Px: px = 1-Cx;
performing curve curvature change consistency analysis, and setting de as average difference delay;
ce is the difference fluctuation level of the detected IP delay time, and di is the detected IP delay time difference of the current detection;
pe is the fluctuation matching level of the delay time length of the curve obtained by the tested IP address, and Pe = 1-Ce;
pv is the value that a certain IP matches the ping command fingerprint characteristic curve in one detection,
the region corresponding to the ping command fingerprint characteristic curve with the maximum Pv value is the region of the IP address to be tested.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210380585.9A CN114785719B (en) | 2022-04-13 | 2022-04-13 | IP region attribution method for forming region fingerprint through ping command |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210380585.9A CN114785719B (en) | 2022-04-13 | 2022-04-13 | IP region attribution method for forming region fingerprint through ping command |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN114785719A true CN114785719A (en) | 2022-07-22 |
| CN114785719B CN114785719B (en) | 2024-05-10 |
Family
ID=82429152
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210380585.9A Active CN114785719B (en) | 2022-04-13 | 2022-04-13 | IP region attribution method for forming region fingerprint through ping command |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN114785719B (en) |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20020073199A1 (en) * | 2000-05-26 | 2002-06-13 | Matthew Levine | Method for extending a network map |
| CN103516725A (en) * | 2007-03-12 | 2014-01-15 | 思杰系统有限公司 | Systems and methods for using compression histories to improve network performance |
| CN104135547A (en) * | 2014-07-31 | 2014-11-05 | 深圳市腾讯计算机系统有限公司 | IP (Internet Protocol) address attribute verification method and system |
| US20150201298A1 (en) * | 2013-03-30 | 2015-07-16 | Tsinghua University | Method for positioning ip location and server |
| CN107508925A (en) * | 2016-06-14 | 2017-12-22 | 阿里巴巴集团控股有限公司 | A kind of method and apparatus for being used to determine the regional information of IP address |
| CN113824810A (en) * | 2021-08-23 | 2021-12-21 | 南京莱克贝尔信息技术有限公司 | Target-driven IP address geographic position inference method |
-
2022
- 2022-04-13 CN CN202210380585.9A patent/CN114785719B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20020073199A1 (en) * | 2000-05-26 | 2002-06-13 | Matthew Levine | Method for extending a network map |
| CN103516725A (en) * | 2007-03-12 | 2014-01-15 | 思杰系统有限公司 | Systems and methods for using compression histories to improve network performance |
| US20150201298A1 (en) * | 2013-03-30 | 2015-07-16 | Tsinghua University | Method for positioning ip location and server |
| CN104135547A (en) * | 2014-07-31 | 2014-11-05 | 深圳市腾讯计算机系统有限公司 | IP (Internet Protocol) address attribute verification method and system |
| CN107508925A (en) * | 2016-06-14 | 2017-12-22 | 阿里巴巴集团控股有限公司 | A kind of method and apparatus for being used to determine the regional information of IP address |
| CN113824810A (en) * | 2021-08-23 | 2021-12-21 | 南京莱克贝尔信息技术有限公司 | Target-driven IP address geographic position inference method |
Also Published As
| Publication number | Publication date |
|---|---|
| CN114785719B (en) | 2024-05-10 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112769702B (en) | Router positioning method based on router alias and reference point geographic features | |
| CN104703143B (en) | A kind of indoor orientation method based on WIFI signal intensity | |
| CN105577477B (en) | Use the IP address geo-positioning system based on measurement of probabilistic model | |
| CN104699835A (en) | Method and device used for determining webpages including POI (point of interest) data | |
| CN110995885B (en) | IP positioning method based on router error training | |
| CN105933975A (en) | WiFi fingerprint-based accuracy improved indoor positioning method | |
| CN109379698B (en) | Cell measurement report positioning method and system based on channel model feature extraction | |
| CN104602341B (en) | Indoor WLAN localization methods based on the mapping of random user signal logic figure | |
| CN108562867B (en) | Fingerprint positioning method and device based on clustering | |
| CN108566620A (en) | A kind of indoor orientation method based on WIFI | |
| CN110493363A (en) | A kind of discrimination system and method for smart phone random MAC address | |
| CN111985569B (en) | Anonymous node positioning method based on multi-source point clustering idea | |
| CN110326323B (en) | Method and device for acquiring emission probability, transition probability and sequence positioning | |
| CN110907903B (en) | Self-adaptive tracking processing method based on multiple sensors | |
| CN109547294B (en) | Networking equipment model detection method and device based on firmware analysis | |
| CN114785719A (en) | IP region attribution method for forming region fingerprint through ping command | |
| CN114202025A (en) | Multi-sensor data fusion method | |
| CN116821777B (en) | Novel basic mapping data integration method and system | |
| CN109284409A (en) | Picture group geographic positioning based on extensive streetscape data | |
| CN111581475B (en) | System and method for identifying identifier and analyzing flow | |
| US11792110B2 (en) | Geolocation system and method | |
| CN111343664B (en) | User positioning method, device, equipment and medium | |
| CN113395211B (en) | Routing IP positioning optimization method based on clustering idea | |
| CN115905793A (en) | Track reproduction method based on Internet of things and curve fitting | |
| CN113824810A (en) | Target-driven IP address geographic position inference method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |