Internet Protocol Geolocation: Development of a Delay-Based Hybrid Methodology for Locating the Geographic Location of a Network Node

摘要

Internet Protocol Geolocation (IP Geolocation), the process of determining the approximate geographic location of an IP addressable node, has proven useful in a wide variety of commercial applications. Commercial applications of IP Geolocation include market research, redirection for performance enhancement, restricting content, and combating fraud. The potential for military applications include securing remote access via geographic authentication, intelligence collection, and cyber attack attribution. IP Geolocation methods can be divided into three basic categories based upon which information is used to determine the geographic location of the given IP address: 1) Information contained in databases, 2) information that is leaked during connections with the IP of interest, and 3) network-based routing and timing information. This thesis focused upon an analysis in the third category: delay-based methods for IP Geolocation. Specifically, a comparative analysis of three existing delay-based IP Geolocation methods: Upper-bound Multilateration (UBM), Constraint Based Geolocation (CBG), and Time to Location Heuristic (TTLH) is conducted using a simulated network. Based upon analysis of the results, a new hybrid methodology is proposed to improve the accuracy when conducting IP Geolocation. Simulations of the new hybrid methodology show that the hybrid methodology is superior to all existing delay- based methods for IP Geolocation.