GraphNEI: A GNN-based network entity identification method for IP geolocation

Abstract

Network entity geolocation technology is a technique for inferring geographic location through features such as network measurements or IP address searchable information, also known as IP geolocation. By obtaining the device type of the target can assist in target IP geolocation or IP landmark mining. Most traditional rule-based or learning-based methods identify network entities. However, due to the existence of firewalls and the limitations of feature detection, the features of individual targets are prone to be missing or spoofed, which can lead to a decrease in the accuracy of network entity identification (NEI). This paper propose a graph neural network-based network entity identification method, GraphNEI model, which embeds network entities into the graph structure and uses graph neural networks to improve the current problem of missing or spoofed features in order to improve the accuracy of current network entity identification. It mainly includes five steps: data processing, subgraph partition, weight calculation, node update and classification. First, the acquired dataset is subjected to feature extraction and anonymization; second, the target nodes are subjected to network topology graph construction and community division; third, the nodes’ self-attention, structural attention and similarity of neighbors are combined and used to calculate the nodes’ combined attention; fourth, node aggregation and update, and update the node representation based on the combined attention results; finally, the nodes are classified. We successfully identified 7 different network entities on the publicly collected dataset, and the identification accuracy of network entities is above 95.49%, improved 0.51%–10.42% compared to typical rule-based or learning-based methods. It effectively improves the effective NEI in the absence of network entity features. In addition, we conduct IP geolocation research based on NEI, and the experimental results show that the method is effective in reducing IP geolocation errors distance.