Probabilistic inference of Internet node geolocation with anomaly detection
Neehar Mukne, Randy Clinton Paffenroth · 2017
Many Internet Protocol geo-location services and applications assume that all IP addresses within the same /24 IP version 4 prefix are in the same physical location, and in this paper we consider the challenge of detecting when this assumption is not valid. In the literature, block co-locality is often evaluated on the basis of the characteristics of latency measurements between Internet nodes with the assumption that similar delay measurements indicate that nodes reside in similar locations. In this paper, our contribution revolves around computing the probability of IP addresses in a pair of /24 blocks belonging to a pair of clusters. These probabilities are computed using hierarchical clustering combined with the bootstrap method and these methods promise to provide many important insights into the relationship between geolocation information and communication latencies. We will discuss how such information can be used for cyber-defense related applications including detection of virtual private networks and anomalous access patterns.