WO2016070483A1

WO2016070483A1 - Ip address database inferring and filling method

Info

Publication number: WO2016070483A1
Application number: PCT/CN2014/095169
Authority: WO
Inventors: 胡新静; 李晓东; 耿光刚; 陈勇
Original assignee: 中国科学院计算机网络信息中心
Priority date: 2014-11-06
Filing date: 2014-12-26
Publication date: 2016-05-12
Also published as: CN104333616B; CN104333616A

Abstract

The present invention relates to an IP address database inferring and filling method. The method combines a network topology obtained in combination with Traceroute probing, corrects and fills IP address ownership data, a basic processing unit being a C network segment (or a smaller network segment), the method being based on the following statistical patterns: for the IPs of a consecutive three-hop route appearing in a Traceroute probe, if the IP of the previous hop and the IP of the next hop have the same geographical location (the same province or the same city), the IP of the middle hop should also have the same geographical location; the same applies to the ISPs; if the IPs of the previous hop and the next hop also have the same ISP with the same location, the probability of the middle routing IP having the same location becomes greater. The present invention utilizes data obtained through automatic probing to correct and fill IP geographical location and ISP information in the IP address database, thus increasing coverage of the IP address database, and correcting the data of the IP address database.

Description

Inference and filling method of IP address library

Technical field

The invention belongs to the field of network technologies, and particularly relates to a method for inferring and filling an IP address library, which is used for correcting and filling the geographical location and ISP information of the IP in the IP address library of the Traceroute detection.

Background technique

The method of the present invention is based on the results of the Traceroute detection. Take Traceroute based on UDP high-port as an example. The working process is as follows: Traceroute sends a series of UDP packets with a TTL (Time To Live) value starting from 1 to the destination host. When the router processes, its TTL value is decremented by 1. When the intermediate router finds that the TTL expires when receiving the packet, it will reply the ICMP time-exceeded message to the source host, so that the source host gets its own distance. The routing IP address given the far hop count. When the packet arrives at the destination host, the destination host replies with an ICMP destination unreachable message, and the probe terminates. In this way, we obtain the routing and forwarding path from the source address to the destination address, and use this path to build the network topology.

The IP address pool usually provides information such as the geographical location of the IP address segment and the ISP (Internet Service Provider). It is usually evaluated from coverage, granularity, and accuracy. At present, there are many free and charged IP address libraries, but usually rely on netizens feedback, research and other methods to collect and verify the addresses of these IP address pools and ISP attribution information, which is not automatic enough.

Summary of the invention

The present invention is directed to the above problem, and proposes an inference and filling method of an IP address library, which can use the data obtained by automatic detection to correct and fill the geographical location and ISP information of the IP in the IP address library, improve the coverage of the IP address library, and correct IP address library data.

The IP address filling method of the present invention combines the network topology obtained by the Traceroute detection to correct and fill the IP address attribution data, and the basic unit of processing is the C network segment (which may also be a smaller network segment). The inference and filling method is based on the following statistical rule: for the IP of consecutive three-hop routes appearing in the Traceroute probe, if the IP of the previous hop and the IP of the next hop have the same geographical location (same province or same city), then the middle one The address of the hopped IP should also be the same geographical location. The same is true for ISPs. If the forward and backward hop IPs also have the same ISP if they have the same address, the probability that the intermediate route IP is the same address is greater.

Specifically, the technical solution adopted by the present invention is as follows:

A method for inferring and filling an IP address library, as shown in FIG. 1, the steps thereof include:

1. For an IP, find the consecutive three-hop IPs that meet the IP address of the forward and backward hops from the Traceroute data, and record the C segments corresponding to the three IP addresses or smaller network segments, and record them as preNet, midNet and nextNet. (Where, preNet≠midNet and midNet≠nextNet); for midNet, generate the following tuple list for each network segment (C segment or smaller segment):

midNet: (preNet ₁ , nextNet ₁ ), ..., (preNet _x , nextNet _x );

2. Using the given IP address pool and the list of tuples extracted in step 1, each tuple will "vote out" a candidate address data for midNet according to the following validation and populated statistical rules: if in the tuple The forward and backward jumps have the same address, and for the intermediate one-hop IP, the candidate address data is obtained by the tuple, that is, the same address as the forward and backward jumps.

In this way, midNet gets a list of candidate addresses. If each candidate address in the candidate address list is the same, it ends as a final decision result; if each candidate address in the candidate address list is different, the following steps are continued.

3. Using the results of step 2, determine the information of the midNet, the specific method is:

1) For each candidate address geo _i , the records are selected by which tuples are voted, and the number of these tuples is counted as count _i . Then count the following indicators:

· The number of occurrences of the link preLink of the previous hop subnet and the intermediate routing subnet preLinkCount;

· The number of occurrences of the nextLink of the next hop subnet and the intermediate routing subnet nextLinkCount;

· The number of tuples with the same ISP of the ISP before and after jumping to the sameISACount;

• The address information authority value of each of the hops and hops (set by the relevant experts) preGeoWeight and nextGeoWeight.

2) Calculate the score GeoScore _i for each candidate address:

Where α, β, γ are coefficients, f, g,

Is a function definition. In practical applications, the values of the parameters and the definition of the function can be determined according to the situation. The simplest can take α=0, β=0, γ=0, c=1, which means that the scores of the candidate addresses are the same.

4. For all candidate addresses and their scores, according to the score level, the obtained candidate address list is used as the final judgment result of the midNet address, thereby realizing the correction and filling of the original IP address data. As shown in Figure 1, if the intermediate route If the C network segment originally has no address, the candidate address list finally obtained in this step is filled with the original address database; if the intermediate route C network segment originally has an address, and the original address is in the candidate list, the step is finally obtained. The candidate address list verifies the original address database data; if the intermediate route C network segment originally has an address, and the original address is not in the candidate list, the candidate address list finally obtained in this step corrects the original address database data.

Further, in step 3, in the actual application, the function f, g can be determined according to the situation.

Functions can be defined and adjusted based on different network structures or management situations and pre-obtained knowledge. There is no fixed standard method. In a preferred embodiment of the invention,

GeoScore _i =∑((preGeoWeight _j +nextGeoWeight _j )*lg(1+min(preLinkCount _j +nextLinkCount _j )))

The correction and filling effect obtained in this way is better.

Further, in step 4, the candidate list is obtained by using the above steps for the city and the province respectively. If the candidate list of the province does not include the province corresponding to each city in the city candidate list, the missing provinces are also added to the candidate list of the province. .

The method of the invention is simple to implement and can correct and supplement the data of the IP address library. The method is relatively effective and low in cost, and does not require field research to confirm the IP address and ISP attribution information, and does not need to rely on the feedback of the netizen when the network is detected. This method can cover more IP when the topology data increases.

DRAWINGS

1 is a flow chart showing the steps of a method for inferring and filling an IP address library of the present invention.

detailed description

The above described objects, features and advantages of the present invention will become more apparent from the aspects of the appended claims.

Example 1:

Example of IP address inference and padding: Take the IP address 183.151.162.1 as an example. The address in the library is in Zhejiang Province, the city is uncertain, and the operator is telecommunications. The list of the forward and backward hops of the intermediate route is shown in Table 1, as follows:

Table 1. List of subnet tuples with the same address before and after the route

After step 2, the voting result as shown in Table 2 is obtained.

Table 2. Voting lists for the forward and backward hops of the route

It can be seen from Table 2 that the alternative voting result is unique, the province is Zhejiang, the city is Lishui, and the operator is telecommunications. Since the candidate results are unique, no further statistical calculation is needed. The inferred address result is the same as the information in the original IP address pool, the city information is supplemented, and the ISP information is the same. In this case, the current method verifies the province information and operator information of the address, and the city information is filled.

Example 2: (Alternative voting results are not unique and require further statistical calculations)

Take the IP address 118.84.3.0 as an example. The address in the library is Beijing, and the carrier is telecommunications, which is the IP network segment of the backbone network. The list of forward and backward hops (partial interception) of the intermediate route is shown in Table 3, as follows:

Table 3. List of subnet tuples with the same address before and after the route

After step 2, the voting result as shown in Table 4 is obtained.

Table 4. Voting lists for the forward and backward hops of the route

Then, as can be seen from Table 4, there are two voting results for the address: Beijing and Hefei, Anhui, and the results of the ISP voting are Telecom and China Unicom. According to the simplest formula, the scores of each result of the voting are the same. If the influence factor of the number of links before and after the network is taken into consideration, the score of Beijing should be higher than that of Hefei Anhui, and the judgment result of ISP is also the same. Therefore, the results verify the results in the database.

The above embodiments are only used to illustrate the technical solutions of the present invention, and the present invention is not limited thereto, and those skilled in the art can modify or replace the technical solutions of the present invention without departing from the spirit and scope of the present invention. The scope of protection shall be as stated in the claims.

Claims

A method for inferring and filling an IP address library, the steps of which include:

1) For an IP, find the consecutive three-hop IPs that meet the IP address of the forward and backward hops from the Traceroute data, and record the C segments corresponding to the three IP addresses or smaller network segments, and record them as preNet, midNet and nextNet. Among them, preNet≠midNet and midNet≠nextNet; for midNet, generate the following tuple list of each network segment pair:

midNet: (preNet 1 , nextNet 1 ), ..., (preNet x , nextNet x );

2) Using a given IP address library and a list of tuples extracted in step 1), each tuple voted for a candidate address data of midNet according to the following statistical rules: if the forward and backward jumps in the tuple have the same address , for the intermediate one-hop IP, the candidate address data is obtained by the tuple, that is, the same address as the forward and backward jumps; thereby obtaining the candidate address list of the midNet; if each candidate address in the candidate address list is the same, then as the final The determination result ends; if each candidate address in the candidate address list is different, the following steps are continued;

3) Using the results of step 2) to determine the information of the midNet, the specific method is:

a) For each candidate address geo i , record which tuples are voted for, the number of these tuples is counted as count i , and then the following indicators are counted:

The number of occurrences of the link preLink of the previous hop subnet and the intermediate routing subnet preLinkCount;

The number of occurrences of the link of the next hop subnet and the intermediate routing subnet nextLinkCount;

The number of tuples with the same hops of the ISP before and after jumping to the sameISACount;

The address information authority values preGeoWeight and nextGeoWeight of the hop-hopping subnets;

b) Calculate the score GeoScore i for each candidate address:

Where α, β, γ are coefficients,
Is a function definition determined according to the actual situation;

4) For all candidate addresses and their scores, the scores are ranked according to the score, and the obtained candidate address list is used as the final judgment result of the midNet address, thereby realizing the correction and filling of the original IP address data.
The method of claim 1 wherein the formula for calculating the score GeoScore i for each candidate address in step 3) is:

GeoScore i =∑((preGeoWeight j +nextGeoWeight j )*lg(1+min(preLinkCount j +nextLinkCount j ))).
The method according to claim 1, wherein in step 4), the candidate list is used for the city and the province respectively, and if the candidate list of the province does not include the province corresponding to each city in the city candidate list, the candidate will be missing. The provinces are also added to the list of candidates for the province.