A Learning-Based Approach for IP Geolocation

  • Brian Eriksson
  • Paul Barford
  • Joel Sommers
  • Robert Nowak
Part of the Lecture Notes in Computer Science book series (LNCS, volume 6032)


The ability to pinpoint the geographic location of IP hosts is compelling for applications such as on-line advertising and network attack diagnosis. While prior methods can accurately identify the location of hosts in some regions of the Internet, they produce erroneous results when the delay or topology measurement on which they are based is limited. The hypothesis of our work is that the accuracy of IP geolocation can be improved through the creation of a flexible analytic framework that accommodates different types of geolocation information. In this paper, we describe a new framework for IP geolocation that reduces to a machine-learning classification problem. Our methodology considers a set of lightweight measurements from a set of known monitors to a target, and then classifies the location of that target based on the most probable geographic region given probability densities learned from a training set. For this study, we employ a Naive Bayes framework that has low computational complexity and enables additional environmental information to be easily added to enhance the classification process. To demonstrate the feasibility and accuracy of our approach, we test IP geolocation on over 16,000 routers given ping measurements from 78 monitors with known geographic placement. Our results show that the simple application of our method improves geolocation accuracy for over 96% of the nodes identified in our data set, with on average accuracy 70 miles closer to the true geographic location versus prior constraint-based geolocation. These results highlight the promise of our method and indicate how future expansion of the classifier can lead to further improvements in geolocation accuracy.


Latency Measurement Kernel Density Estimator Likelihood Probability PlanetLab Node Geolocation Accuracy 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Madhyastha, H., Isdal, T., Piatek, M., Dixon, C., Anderson, T., Krishnamurthy, A., Venkataramani, A.: iPlane: An Information Plane for Distributed Services. In: USENIX OSDI 2006 (November 2006)Google Scholar
  2. 2.
    Maxmind geolocation database,
  3. 3.
    Gueye, B., Ziviani, A., Crovella, M., Fdida, S.: Constraint-based geolocation of internet hosts. IEEE/ACM Transactions on Networking (December 2006)Google Scholar
  4. 4.
    Wasserman, L.: All of Nonparametric Statistics (May 2007)Google Scholar
  5. 5.
    Lakhina, A., Byers, J., Crovella, M., Matta, I.: On the Geographic Location of Internet Resources. IEEE Journal on Selected Areas in Communications (August 2003)Google Scholar
  6. 6.
    Eriksson, B., Barford, P., Nowak, R.: Network Discovery from Passive Measurements. In: ACM SIGCOMM 2008 (August 2008)Google Scholar
  7. 7.
    Ng, E., Zhang, H.: Predicting Internet Network Distance with Coordinate-baseed Approaches. In: IEEE INFOCOM (April 2002)Google Scholar
  8. 8.
    Rish, I.: An Empirical Study of the Naive Bayes Classifier. In: Workshop on Empirical Methods in Artificial Intelligence (2001)Google Scholar
  9. 9.
    Wong, B., Stoyanov, I., Sirer, E.G.: Octant: A comprehensive framework for the geolocation of internet hosts. In: USENIX NSDI 2007 (April 2007)Google Scholar
  10. 10.
    Bavier, A., Bowman, M., Chun, B., Culler, D., Karlin, S., Muir, S., Peterson, L., Roscoe, T., Spalink, T., Wawrzoniak, M.: Operating System Support for Planetary-Scale Network Services. In: USENIX NSDI 2004 (March 2004)Google Scholar
  11. 11.
    Oregon Route Views Project,
  12. 12.
    Augustin, B., Cuvellier, X., Orgogozo, B., Viger, F., Friedman, T., Latapy, M., Magnien, C., Teixeira, R.: Avoiding traceroute anomalies with Paris traceroute. In: ACM IMC 2006 (October 2006)Google Scholar
  13. 13.
    Luckie, M., Hyun, Y., Huffaker, B.: Traceroute Probe Method and Forward IP Path Inference. In: ACM IMC 2008 (October 2008)Google Scholar
  14. 14.
    Spring, N., Mahajan, R., Wetherall, D.: Measuring ISP Topologies with Rocketfuel. In: ACM SIGCOMM 2002 (August 2002)Google Scholar
  15. 15.
    Heidemann, J., Pradkin, Y., Govindan, R., Papadopoulos, C., Bartlett, G., Bannister, J.: Census and Survey of the Visible Internet. In: ACM IMC 2008 (October 2008)Google Scholar
  16. 16.
    Wang, H., Jin, C., Shin, K.: Defense against spoofed IP traffic using hop-count filtering. IEEE/ACM Transactions on Networking 15(1), 40–53 (2007)CrossRefGoogle Scholar
  17. 17.
    Katz-Bassett, E., John, J.P., Krishnamurthy, A., Wetherall, D., Anderson, T., Chawathe, Y.: Towards IP Geolocation Using Delay and Topology Measurements. In: ACM IMC 2006 (October 2006)Google Scholar
  18. 18.
    Zhang, M., Ruan, Y., Pai, V., Rexford, J.: How DNS Misnaming Distorts Internet Topology Mapping. In: USENIX Annual Technical Conference (2006)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2010

Authors and Affiliations

  • Brian Eriksson
    • 1
  • Paul Barford
    • 1
  • Joel Sommers
    • 2
  • Robert Nowak
    • 1
  1. 1.University of Wisconsin - Madison 
  2. 2.Colgate University 

Personalised recommendations