WO2006012219A2

WO2006012219A2 - Method and system for determining the probability of geographical origin of a networked device

Info

Publication number: WO2006012219A2
Application number: PCT/US2005/022287
Authority: WO
Inventors: Ian R. Nandhra
Original assignee: Findbase Llc
Priority date: 2004-06-28
Filing date: 2005-06-22
Publication date: 2006-02-02
Also published as: WO2006012219A3

Abstract

A system, method and apparatus to aid in the identification of the geographical location of a user of a network address in a distributed and non-distributed environment. Mechanisms are provided to facilitate the validation of data and the sharing of data and such other data such as is required. Improved mechanisms are also provided for increasing and decreasing granularity of the identified locations.

Description

METHOD AND SYSTEM FOR DETERMINING THE PROBABILITY OF GEOGRAPHICAL ORIGIN OF A NETWORKED DEVICE

BACKGROUND OF THE INVENTION The present invention relates to a method of determining the probability that a network address is or is not being used in particular geographical area or particular location on a network.

"IP addresses" are used to uniquely identify a particular device on networks such as the Internet from other devices on the network. IP addresses are unique, but might not be directly related to any specific user. For example, the IP address a user uses to access the network might be different each time they access the network.

The anonymity the Internet provides makes identification of who is using an IP address where and when very difficult. While some consider this anonymity to be an integral part of personal privacy, others, such as financial institutions, would like to identify IP usage to combat fraud.

There are many advantages of identifying the geographical or physical location of a unique device or user connected to a network. For example, financial institutions could provide enhanced security for transactions performed on networks if the geographical location of the user could be established.

Geographical locations such as the popular Global Positioning System (GPS) have been used for many years. Such systems typically require an electronic receiver intercepting signals from a number of transmitters in known locations. Examples of such transmitters include but should not be considered limited to stationary radio beacons, geo-stationary satellites and other transmitters moving in a predictive manner. Assuming that the transmitted signals traveled at a known speed, in a straight line or in a predictive manner and were unaffected by factors such as electromagnetic radiation and natural obstacles such as trees, the receiver could determine its location from the time taken to receive data from the transmitters. Other geographical location systems include sonar and radar such as can be found in Military and aeronautical applications.

The techniques upon which such geolocation methodologies are unsuited to networks since the distance between the interconnected devices is unknown as is the time taken for a signal^'to be sent from a source to a specific destination. Network switching and routing elements can dynamically vary the path data will take between a source and a destination. Furthermore, Figure 1 shows an example of back-hauling typical of that found on the Internet. A device located in Denver (102) is connected to an Internet Gateway 106 in Los Angeles through a DSL connection (104). Particular attention is drawn to the fact that network operations such as email and web browsing performed by device (100) will appear to come from the connection point 106. Attempts to geographically triangulate the location of device (102) against fixed locations with predictive timing characteristics would result in Los Angeles (106) since that is the entry point to the Internet. Even if the distance between points 102 and 106 could be established, it would only describe an arc radius from points 100 to 108 due to the inability of device 102 to access any other known geographical point. Admittedly it would be possible for device (100) to perform other tests to determine its location, but such tests would be specific to device 100 and not necessarily portable across all devices in the network. There are many products and services attempting to map or otherwise locate the geographical location of an IP address and such techniques suffer from numerous problems, including but not limited to:

1. Users connecting to a network through a phone or DSL system in one geographical location that in turn connects to the network in a totally different location in a process termed 'back-hauling".

2. There is no accurate directory that maps an IP's assigned owner to an organization.

3. There is no registry of what an IP's assigned owner is doing with an IP

4. IP addresses, assigned owners and usage locations change very quickly and without notice.

Attempts to identify the geographical location of an IP are rendered ineffective due to the lack of accurate information and the problems associated with disclosing information that could be considered by some parties to be personal and private or would be prohibited by applicable laws. Registries of IP addresses to geographical locations exist, one such being www.arin.net but lack of guarantees as to the authenticity or accuracy of such information renders it virtually useless for purposes such as secure financial transactions. Errors and omissions in databases such as www.arin.net are commonplace and should be expected. Networks typically contain switching equipment and routers to direct data between source and destinations. Example connectivity between major Internet network providers and their hubs within the United States of America is shown in Figure 2. Admittedly the network nodes and users within these topologies change, those versed in the art will recognize that the major hubs and distribution centers have a relatively slow rate-of-change. Using the public highway system in the United States of America as an analogy, it is uncommon, for example, to find that the interstate connections between Highways 5, 99, 88 and 80 in the Sacramento area of California have physically moved somewhere else. Figure 2 shows an example layout of the routes, routers and hubs on the Internet by the number of routers, hubs and Network Providers should in no way be considered restricted to that shown in this example. In a practical network, the Internet being one example, the number of routers and hubs and their interconnections will vary over time. Routers and switching equipment are typically assigned an IP address that uniquely identifies them from other equipment connected to the network. Additionally, it is common practice within the art for devices connected to networks to be assigned a name conveying meaning to those installing and maintaining the network. For example, a router for the popular Internet provider Comsec.Net has a uniquely assigned EP address of 207.212.96.65 and also the descriptive name interlock.comsec.net. Another Internet provider, SBC Global has assigned descriptive names to IP addresses as shown in the table:

Since it is common for such descriptive names to be entered into a Domain Name Map an example being the global Internet DNS, bbl-gl- O.sktnOl. pbi.net is the DNS name equivalent of IP address 63.200.104.106. Conversely, the IP address 151.164.188.117 maps to the DNS name bbl-p9- 2. sntc01.pbi.net. Particular attention is drawn to component parts of the name bbl-gl- 0. sktn01.pbi.net where bbl-gl-0 is an internal PBI code, sktnOl is a geographical reference to a physical location (in this case Stockton, California, USA) and pbi.net is the name of the Internet provider, in this case, SBC Global. Admittedly other network providers may have different conventions that may not necessarily provide any useful name-to-EP mapping, but it is common for organizations to assign meaningful names if only for their own administrative purposes. Admittedly there may be no special meaning to these Id's and indeed such Id's may not be unique but their assignation coupled with their EP address provides a form of identification. Irrespective of where the router "bbl-gl-O. sktn01.pbi.net" is physically located, we can determine the geographical it services - the service area by accessing it from a known location with a network access program such as tracert that will be familiar to those versed in the art of Networking. The more devices known to be in Stockton that access the router "bbl-gl-0. sktn01.pbi.net", the higher the probability that its service area is Stockton, California. It is commonplace for routers to have a plurality of different service areas.

Public access tracert servers at known geographical locations one example being http://www.net.princeton.edu/traceroute.html can be used to identify the service areas of routers on networks such as the Internet. The results from different tracert servers can be combined to form a Service Area Probability Map (SAPM) the accuracy of which is dependant upon the number of accesses from known geographical locations to known geographical locations and the frequency of such accesses.

Other sources of geographical locations are available an example of which occurs during Credit Card transactions performed over the Internet. It is commonplace for financial institutions performing the transaction to reduce fraud by comparing a particular or current transaction with a historical record of previous transactions. It is also commonplace for merchants selling on the Internet to require a credit card user to, during the transaction, supply a geographical address registered with the financial institution that issued the credit card. Clearly attempts at reducing fraud and credit card user identification would benefit from knowing the geographical locations of the unique network addresses. Additionally, the geographical information used during the credit card transaction could be used within a SAPM. For example, a successful on-line credit card transaction associates the registered address with the IP being used for the transaction and the frequency of such transactions would increase the probability that the IP is associated with a validated credit card address. Since the user of the credit card could be using an IP address that is in a completely different geographical location, the association is combined with other information such as the Service Area of the router that the IP address uses to connect to the network. For example, a SAPM formed from 5000 verifiable instances indicating a Service Area of San Jose could be considered more reliable than a SAPM formed from 5 verifiable instances. Network equipment such as routers and switching equipment are subject to failure, relocation and replacement that could detrimentally affect the future accuracy of a SAPM. Clearly there is a correlation between the age of the entries comprising an SAPM and the number of times the Network Equipment, assigned names or IP addresses have changed. A high rate-of-change of network characteristics decreases the accuracy probability of SAPM entries over time. Changes in network characteristics will result in sudden and major changes to a SAPM consistent with the specific nature of the change that will be apparent when compared with the normal rate of change of the SAPM.

BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 An example of back-haulingFIG. 2 Map of Internet hubs and connections

FIG. 3 Example Internet Router and Hub configuration FIG. 4 Example tracert output FIG. 5 Example NAP and SAPM

FIG. 6 Example ApplicationDET AILED DESCRIPTION OF THE

INVENTION In accordance with one broad aspect, a mechanism is provided to analyze the data provided from public tracert servers and store the analysis results and said data in a service area probability map (SAPM).

In accordance with another broad aspect, a mechanism is provided to maintain the SAPM with data defining the geographical location of an unique network address from other sources such as but not limited to Credit Card authorizations and financial transactions where the geographical location of the transactor has been previously determined. In accordance with another broad aspect, a mechanism is provided to share the data contained in the SAPM with other SAPM 's in a networked and distributed space environment.

As used herein, the term Network Access Point (NAP) is meant broadly and not restrictively, to include any device or machine capable of connecting a single or plurality of uniquely identifiable devices to a network.

As used herein, the term Network Access Point Characteristics (NAPC) is meant broadly and not restrictively, to include the characteristics that identify the behavior and identification of a NAP. Such characteristics can include but should in no way be considered limited to the NAP's unique identification, the type of devices connected to it and the nature of the specific accesses such devices make.

As used herein, the term Service Area (SA) is meant broadly and not restrictively to include the geographical area encapsulating the locations of network devices connecting to a NAP. As used herein, the term Rate Of Change (ROC) is meant broadly and not restrictively to be the frequency of change with respect to another value or plurality of values. For example, the ROC for a NAP might reflect the number of times the NAP has been repaired within a specific time period. In another example, the ROC represents the number of functional changes or configuration changes that have occurred within a specific time period. In another example, ROC of EP access measures the rate of change of different IP addresses accessing a NAP or comprising a NAPC over time. In another example, ROC measures the frequency with which a Service Area changes over a period of time.

As used herein, the term Service Area Probability Map (SAPM) is meant broadly and not restrictively, to include any device or machine capable of accepting data, applying processes to the data, and supplying results of the processes.

As used herein, the term "Storage" is meant broadly and not restrictively, to include a storage area for the storage of computer program code and for the storage of data and could be in the form of magnetic media such as floppy disks or hard disks, optical media such as CD-ROM or other forms.

As used herein, the term "tracert" is meant broadly and not restrictively, to include any device capable of determining the characteristics of the network path connecting a source to a destination. One example of "tracert" is the "tracert" utility program supplied with the popular Windows™ Operating system. Another example of "tracert" is the output from public tracert servers one such example being http://www.es.net/hypertext/welcome/pr/trace.html. Another example of tracert is a computer software device or computer program written to gather network characteristics without reliance on any particular equipment or device. With reference to Figure 3 we see a high capacity networks (302, 306,

312, 314) interconnecting NAP's at geographical locations (300, 306, 308, 312, 320). A particular NAP (308) performs the required operations consistent with the specific needs of a particular geographical location irrespective of the actual geographical location of the NAP or its rate of change over time. A single or plurality of Network devices such as web browsers (304) connect to the network through NAP (308) the geographical location of which may be subject to change. If the network devices (304) can be proven to be located in specific geographical locations, there is an increased probability that NAP (308) services the aforementioned geographical locations. For example, the network devices (304) define "Stockton" to be one Service Area of the NAP (308). Particular attention is drawn to the ability of a NAP to connect devices in a plurality of different geographical locations that define a plurality of SAP's. Attention is draw to the network devices (318) physically located at a organization called FINDbase in the geographical area of Sonora California and connecting to the Internet backbone (314) at Stockton through NAP (308). The Service Area for NAP (308) can now be considered be at Stockton and "FINDbase at Sonora". Since network devices in other geographical areas may connect to NAP (308) at any time and connected network devices might disconnect from NAP (308) at any time, preferred embodiments use a probability that a particular instant in time a particular NAP has specific Service Areas. With reference to Figure 4 we see an example tracert typical of that used in the art to trace a path taken between a source and destination. In this example tracert, each 'hop' represents a unique NAP encountered between the source device in Hop Line 1 (408) and the desired destination, in this case a network device uniquely identified in the Internet DNS as latimes.com. Turning attention to the first hop (408) enumerated ' 1 ' under the heading HOP (400) the values in columns Timel (402),

Time2 (404), Time3 (406) represent the respective times for three attempts to transmit data from the source to the NAP under the column 408. Subsequent hops can be seen in lines 410, 412, 414, 416, 418, 420, 424, 426, 428, 430, 432, 434 that describe the route taken from the network device a destination (434). Particular attention is drawn to the Hop (434) since it is the closest NAP that can be reached in the path to this particular destination (latimes.com) and should in no way be considered an indication that the destination cannot be reached. If NAP' s are in the same geographical location with respect to the specific embodiments desired granularity, they could be encapsulated by the same SAPM and in consequence a SAPM can be comprised of a plurality of NAP' s and network devices. For example, Zip Code resolution is used in one embodiment where a particular SAPM (438) contains NAP's (440, 442 and 444) whose SA is a particular zip code, hi another embodiment requiring SA resolution respective SAPM's contain a single NAP representing a particular SA. Attention is now directed to the way that the network connection characteristics from for example a tracert are added to a Service Area Probability Map. Paying further attention to Figure 3, we see a NAP (308) in the Stockton geographical area connecting to networks 314 and then network 312 via another NAP in a geographical location San Jose (312). With respect to the output of the example tracert in Figure 4, we see the Stockton NAP (308) identified in Hop 3 (414) and additional NAP's at Hop 4 (416) and Hop 5 (418) both of which are in the Stockton area. A single geographical location can be served by a plurality of NAP's and that the Service Areas of these NAP's can overlap. Equally a SAPM describing a SA can be comprised of devices of devices or other connecting NAP's. For example, a network device connected to the NAP at 416 could also connect to NAP 418. In another example, another network device might always connect to NAP 418. hi another example, another network device might connect to NAP's with different geographical Service Areas. Returning attention to Figure 4, Hop 6 (420) and Hop 7 (422) are in the geographical location of San Jose, California. Each successive Hop from the network device to the destination can be considered in terms of the network topology to be further away from the network device and closer to the destination. Due to the changing and unknown interconnections of the aforementioned network topology, the overall effect is that we move further away from the network device and closer to the destination. To use the domestic highway system in the USA, a journey between two cities might involve routes that temporarily loop back away from the destination or in directions that do not directly relate to the destination. The NAP closest to the network device is considered it's Primary connection point to the network, the next NAP is considered the Secondary connection point and so on until the desired number of NAP's have been identified consistent with the needs of the specific embodiments. Connections to each NAP have a corresponding entry in a SAPM associated with the particular NAP. For example, the SAPM's for the NAP's at each Hop in the tracert depicted in Figure 4 might have other NAP's or network devices connected to them resulting in a corresponding entry in the NAP's SAPM. The characteristics and nature of the SAPM will vary in accordance with the needs of particular embodiments. The format of an example NAP is shown in Figure 5 where we see a SAPM (500) comprising an Identifier (504), a list of NAP's (510) a locator (516) describing the SA, a reliability description (532) and other data as needed by the specific embodiments although the nature of the data encapsulated within the SAPM should in no way be considered restricted to this example.

NAP's (502, 506) described by list (510) comprise such components as required to meet the needs of the specific embodiments but preferred embodiments will incorporate descriptions of: the date the NAP was created (512), the date of the last change to the NAP (518), the date of the first update (534), the ROC between and including the first update (534) and the last update (518), the rate-of-change over time (544), a description of the reliability (548) of the data contained within the NAP and that in the device list (552). Each entry in the Device List (552) uniquely defines the properties of the network device that in this example includes but should in no way be considered restricted to: a unique identifier (520), the date this device first connected to the NAP 536, the most recent connection date (542), the number of connections

(546), information describing the physical location or SA (550) and other information (538). An example physical location (550) could take the form of a Street address, City, State and Zip Code typical of that used in the USA. hi another example, the physical location could be in the form of GPS coordinates. In another example, the physical location could take the form of longitude and latitude.

The Device Data list (552) contains Device Data descriptions for similar geographical areas such that all elements in list (536) would^'be for the same geographical location and would be different to those in other SAPM's, the definition of the geographical location being appropriate to the specific embodiments, hi one example embodiment, network devices on the Internet share blocks of IP addresses such that the particular IP address used will vary from one connection to the next in a commonplace practice known in the art as "IP Leasing". A consequence of "IP Leasing" would be discrete and different Device Data (508, 514) descriptions containing identical network address identifiers appearing in different NAP device lists (552) consistent with the geographical data obtained when the network device accessed the NAP (506, 512). For example, one Device Data block with a network address identifier of 1.2.3.4 in the geographical location of Lodi would appear in a different SAPM to another Device Data block with a network address identifier of 1.2.3.4 in the geographical location of Stockton. In another example with a different geographic resolution, a network address identifier of 1.2.3.4 in the geographical location of Lodi would appear in the same SAPM as another Device Data block with a network address identifier of 1.2.3.4 in the geographical location of Stockton. Since the potential number of entries in the device lists is limited only by the number of unique network addresses preferred embodiments perform such maintenance operations as required to limit the number of entries to manageable proportions. The way in which a particular SAPM encapsulate NAP's will vary between the geographical resolutions needed by the specific embodiments and should in no way be considered limited that described in the aforementioned examples. The data encapsulated in an NAP's Locator (542) represents the geographical resolution of the NAP's Service Area and no correlation should be assumed between the size of the geographical area and the number of SAPM's required to describe it since the number of SAPM's is dictated by the changing network topology encountered by network devices as they connect to the NAP and form a SAPM.

Redirecting attention Figure 4, the geographical location of SAPM 500 is defined by combining the Locator 556 of all the NAP's in the list 510 and Locator 516 the granularity of which is dependant on the needs of the specific embodiments. For example, embodiments requiring City resolution would combine all NAP's with a locator (556) describing a City into one SAPM whose locator (516) would be the required City. In this way, all NAP's formed from accesses in, for example, the geographical area of Stockton, CA, would be contained within a NAP List (510) in a SAMP representing the Stockton, CA area. Although Stockton has been used in this example, other resolutions could require different City's, Counties, States, Zip Codes or such geographical encapsulations as needed by the specific embodiments and should in no way be considered limited to those described in the aforementioned examples. The mechanism by which NAP locators are combined between NAP's such as NAP 506 inferring its geographical location from information such as the access from NAP 502 is dependant upon the needs of the specific embodiments. Information such as that encapsulated in a tracert (Figure 4) enables differentiation between a NAP access and a network device such as a web browser. Preferred embodiments use inter-NAP accesses such as, for example, those between 414 and 416, 416 and 418 and 418, and so on to build a map of the respective NAP's Service Areas. Preferred embodiments would use information such as rate-of-change 544 and reliability 548 within a particular SAPM to indicate the stability of the NAP that can be used, for example, to detect and adjust to changes in network topology. For example, if NAP 506 were replaced by another NAP with a different network address or DNS entry the new NAP would lack the SAPM data from the original NAP. Preferred embodiments detect such changes by identifying differences between successive tracert 's between identical source and destinations. Once a difference has been identified, successive device accesses of similar characteristic to accesses made to the original NAP yield an increasing probability that the new NAP has the same SA as the original NAP and that the original NAP's SAPM 's can be applied to the new NAP.

For example, with further reference to Figure 3, if NAP 308 was replaced there would be a corresponding change in the tracert (Figure 4) performed by network devices accessing the NAP indicating that either the network device has changed in nature such that it is now accessing a different NAP or that the NAP has changed. Such changes are commonplace in networks and should be expected. The time taken to determine that the new NAP has the same or similar Service Area to the old NAP is dependant on the speed at which a probability can be determined that the previous NAP's Service Areas are the same as or similar enough to the new NAP which is in turn directly related to the number of network devices accessing the new NAP and the frequency of such accesses. The relationship between the numbers of different network devices, their access frequency and the derived probability will vary between embodiments. Those versed in the art will recognize that a NAP may itself be comprised of clustered NAP's with different Service Areas and such clustering will depend upon the needs of the specific embodiments. For example, in one embodiment a NAP with a Service Area encapsulating the Los Angeles Metropolitan is comprised of individual NAP's with Service Areas of "Hollywood", "Fullerton", "Anaheim" and "Beverly Hills". In another example embodiment, a Service Area encapsulating an entire State in the USA would be contained within a single NAP. Although these examples show an apparent relationship between the increasing numbers of NAP's providing increasing geographical resolution, such relationships are specific to the network topologies and the individual SAPM, which are dependant on the needs of the specific embodiments.

Attention is now turned to the way in which an example embodiment calibrates locational information and learns from successive user accesses. Figure 6 shows users (600, 602, 604) connecting to NAP (612) and Users 608 connecting to NAP (614) where the bounding SAPM (610) has no knowledge of the geographical locations NAP's (612, 614) since the aforementioned users have not gathered any user tracert information. The Accuracy of Probability (AoP) that the SA for SAPM (610) and NAP's (612, 614) is in a particular geographical area can be improved by successive accesses to the NAP's from known geographical locations one such example being the aforementioned public tracert servers.

Attention is now turned to an example embodiment that utilizes verified geographical information available during Credit Card transactions to form a map that can be used to geographically locate network devices on the Internet. User 1 (600) is making an on-line financial transaction from a network device connecting to the Internet (606) via NAP 612. During the course of the transaction, the network device (600) performs a tracert to a geographically remote location on the Internet other than locations 612, 614 through network connection 606 to a NAP 612. The information provided by a tracert and other information uniquely identifying User 1 and other information that is required, such as the nature of the network device, is transmitted via connection 606 to a Geolocation Server 616 comprising such storage and computational capable of performing steps: a) Decodes interconnected list of NAP's from the tracert information (Figure 4) b) For each of the NAP's identified in (a), updates the list of NAP's and creates new NAP entries if no existing NAP entry exists c) The server obtains Verified Geographical Location Information (VGLI) (624) for the user from a source of such information such as a Credit Card Transaction Authority (CCTA). This geographical location will be assumed to be the one from which the particular user has performed the tracert. If no VGLI is available, preferred embodiments infer Geographical Location Information (GLI) from the proximity of the connected NAP's and other users and the reliability of such GLFs is dependant upon the reliability of the data describing them, d) Identify a NAP from the list generated in step (a) with respect to the desired geographical granularity e) Determine the correct geographical SAPM within the NAP in step (d) and update the SAPM or create a new SAPM if no such SAPM exists. In this example, the Geolocation Server 616 determines the probability that the particular user (in this case, User 1 600) really has connected from the geographical area received from the network device with respect to that obtained in step (c) above and in turn with the granularity of the NAP in step (d) above. For example, if User 1 's puts User 1 in the geographical area of Sonora, California, ZIP 95370, it would be expected that other entries in the SAPM from step (e) would be from the same or similar geographical area as well. The aforementioned SAPM's information is updated to reflect the new access. If the VGLI does not have sufficiently similar matches in the aforementioned SAPM, the "Probability of Accuracy" (PoA) is decreased and conversely if the VGLI does have sufficiently similar matches the PoA is increased. The Accuracy of Probability (AoP) is a measure of the accuracy of the technique employed by specific embodiments to compare SAPM entries and preferred embodiments utilize values for PoA and AoP. This example embodiment transmits a message containing the SAPM's Geographical Service Area and its probability of accuracy to the CCTA that can use the received message for purposes such as but in no way restricted to, determining if the on-line transaction is fraudulent. Credit Card processing organizations can incorporate the geographical location of the network device performing a financial transaction into the card holders spending profile to identify inconsistent spending habits. For example, if the card holder had performed 100 transactions in the greater Los Angeles area which were then followed by "out of normal area" transactions in 4 different and remote geographical locations, the processing organization might chose to decline any or all of the "out of normal area" transactions. Returning attention to Figure 6, Network Users (602, 604, 608) online transactions are performed in the same manner as that described for User 1 (600), each geographically validated access increases the SAPM's PoA.

A ratio (IAR) of the number of devices In Area (IA) to those out-of-area (OOAO can be calculated as: IAR = (#inArea / #outOfArea)

Where IA and OOA can have corresponding PoA values and PoA decreases as the IAR tends to <1

In summary we have described a system that um can be used for determining the probability of geographical origin of a networked device or a network address in a networked environment. The usefulness of the present invention extends beyond the financial services example described herein to other applications such as Law Enforcement, Government Security and identification of where people are on a network are possible although the scope of applications and specific embodiments should in no way be considered restricted to those described.

Claims

What is claimed is:

1. A method of maintaining a service area probability map, comprising: decoding a list of network access points from tracert information; updating an existing list of network access points based on the decoded list of network access points including, for network access points in the decoded list that are not present in the existing list, adding entries in the existing list; and processing verified geographic location information corresponding to the tracert that produced the tracert information to determine a geographical service area probability map for at least one network access point in the existing list.