PinPoint: A Ground-Truth Based Approach for IP Geolocation

Transcription

1 PinPoint: A Ground-Truth Based Approach for IP Geolocation Brian Eriksson Network Mapping and Measurement Conference 2010 Paul Barford Robert Nowak Bruce Maggs

2 Introduction Consider some resource in the Internet Can we estimate the geographic location (geolocation)? Why? Network security Advertising?????

3 Prior Work -Octant Geolocation The current state-of-the-art algorithm, Octant, relies heavily on Traceroute-derived undns hints. undns-most routers have an internal naming convention visible via Traceroute. Octant: A Comprehensive Framework for the Geolocalization of Internet Hosts, Bernard Wong, Ivan Stoyanov, Emin Gün Sirer, In Proceedings of Symposium on Networked System Design and Implementation (NSDI) 2007

4 Prior Work -Octant Geolocation Example Traceroute measurement to cnn.com: 1 1 ms r-cssc-b280c-1-core-vlan-3603-primary.net.wisc.edu [ ] 2 1 ms r-cssc-b280c-9-core-vlan-2034.net.wisc.edu [ ] 3 2 ms r-peer-xe net.wisc.edu [ ] 4 1 ms r-uwmadison-isp-xe wiscnet.net [ ] 5 24 ms te car2.kansascity1.level3.net [ ] 6 15 ms ae car1.kansascity1.level3.net [ ] 7 41 ms ae-5-5.ebr2.dallas1.level3.net [ ] 8 44 ms ae ebr3.dallas1.level3.net [ ] 9 * ae-7-7.ebr3.atlanta2.level3.net [ ] ms ae-2-52.edge4.atlanta2.level3.net [ ] Location hints embedded in router name

5 Prior Work -Octant Geolocation Problems: Heavy network load of Traceroute probes undnshints have proven to be unreliable M. Zhang, Y. Ruan, V. Pai, and J. Rexford, How DNS Misnaming Distorts Internet Topology Mapping," in Proceedings of USENIX Annual Technical Conference, 2006.

6 Prior Work -Octant Geolocation Problems: Heavy network load of Traceroute probes undnshints have proven to be unreliable Can we avoid heavyweight probes and reliance on undns? M. Zhang, Y. Ruan, V. Pai, and J. Rexford, How DNS Misnaming Distorts Internet Topology Mapping," in Proceedings of USENIX Annual Technical Conference, 2006.

7 PinPointOutline Exploiting existing Internet infrastructure with known geolocation

8 PinPointOutline Exploiting existing Internet infrastructure with known geolocation Hop count-based mapping to landmarks Including passive measurement-based geolocation

9 PinPointOutline Exploiting existing Internet infrastructure with known geolocation Hop count-based mapping to landmarks Including passive measurement-based geolocation Geolocation from implied population data using Sparse Embedding

10 PinPointOverview End Host Unknown geolocation Small probing budget

11 PinPointOverview Landmarks Known geolocation No ability to probe from

12 PinPointOverview Monitors Ability to probe to/from # monitors << # landmarks

13 PinPointOverview Consider infrastructure in the Internet with known location as our landmarks Found in a subset of Domain Name Servers Network Time Protocol (NTP) Servers Planetlab Nodes

14 PinPointOverview Consider infrastructure in the Internet with known location as our landmarks Found in a subset of Domain Name Servers Network Time Protocol (NTP) Servers Planetlab Nodes Hypothesis:Information from these known landmarks can aid in geolocation

15 Network Time Protocol (NTP) Servers

16 Domain Name Servers In the San Francisco bay area: DNS LOC Project -

17 Hop Vector Construction Consider taking ping measurements from monitors to each landmark. This generates a hop count vector for each landmark:

18 Hop Vector Construction Consider taking ping measurements from monitors to the end host. This generates a hop count vector for the end host:

19 Hop-based Geolocation Which landmark is the end host closest to? End Host Hop Vector Set of Landmark Hop Vectors

20 Hop-based Geolocation Subnet Network Core Monitors Monitors Monitors

21 Hop-based Geolocation Subnet Monitors Network Core Monitors Single Egress Router to Core Monitors

22 Hop-based Geolocation Subnet Network Core Single Egress Router to Core B. Eriksson, P. Barford, R. Nowak. Network Discovery from Passive Measurements. ACM SIGCOMM Conference Seattle, Washington. August 2008.

23 Hop-based Geolocation Therefore, we assign geolocation as the landmark that has the closest to a constant hop offset.

24 Hop-based Geolocation Therefore, we assign geolocation as the landmark that has the closest to a constant hop offset.

25 Hop-based Geolocation Results Consider a set of 80 Network Time Protocol (NTP) Servers with known location Using 26 Planetlab servers as monitors With each monitor sending Ping measurements to all 80 NTP servers.

26 Hop-based Geolocation Results Consider a set of 80 Network Time Protocol (NTP) Servers with known location Using 26 Planetlab servers as monitors With each monitor sending Ping measurements to all 80 NTP servers. Using Leave-one-out Cross Validationon the NTP nodes, we geolocate by mapping to the estimated closest of the remaining 79 NTP nodes using our hop vector approach.

27 Hop-based Geolocation Results Geolocation Error results: Methodology Hop-Based Mapping Lower Bounds Upper Bounds Random Mapping Mean Error (in miles) Median Error (in miles)

28 Hop-based Geolocation Results Consider confidence estimate:

29 Hop-based Geolocation Results Consider confidence estimate: Separating into Confidence Quintiles: Most Confident Least Confident Quintile Mean Error (in miles) 1 st nd rd th th Median Error (in miles)

30 Passive Hop Mapping What happens when an end host does not respond to Ping probes? Consider constructing the hop count vector via passive measurements. We can observe hop count information and geolocate without the use of any active probing

31 Passive Measurements Monitor

32 Passive Measurements Monitor 1 X X X 4 5

33 Passive Measurements X X X Monitor

34 Incomplete Passive Measurements End Hosts Monitors Observed Incomplete Data Vector

35 Incomplete Passive Measurements As stated previously, not all the end hosts will be seen at each passive monitor Incomplete Passive End Host Hop Vector Set of Landmark Hop Vectors

36 Passive Geolocation Results Commercial Node Dataset -211 end hosts, 200 landmarks, 20 monitors The geolocation performance as a function of the incompleteness of the observed measurements:

37 Passive Geolocation Results Commercial Node Dataset -211 end hosts, 200 landmarks, 20 monitors The geolocation performance as a function of the incompleteness of the observed measurements: Current Commercial Geolocation Packages IP2Location Maxmind

38 Targeted Latency Probing Consider a probing budget for each end host Ability to perform K latency measurements (via Ping) Which K landmarks should be probed?

39 Targeted Latency Probing Hop mapped landmark

40 Targeted Latency Probing K Latency Probe Targets E. Lua, T. Griffin, M. Pias, H. Zheng, and J. Crowcroft, On the accuracy of embeddings for internet coordinate systems, Internet Measurements Conference (IMC) 2005

41 Latitude/Longitude Estimation?

42 Standard Embedding Standard embedding problem: Sum of squared errors of estimated distances versus possible embedding coordinate x.

43 Standard Embedding Problems with standard embedding: Distances are not exact (prone to non-line of sight errors and erroneous hop mapping) Standard embedding will over-fit Ignores additional useful information, such as population density. We do not want to assign lat/long coordinates in the middle of a desert.

44 Sparse Embedding Add a regularization term to the objective function Penalize the distance of embedding from known landmark locations

45 Standard Embedding Standard Embedding Result

46 Sparse Embedding

47 Sparse Embedding Standard Embedding Result

48 Sparse Embedding Sparse Embedding Result Standard Embedding Result

49 Network Time Protocol (NTP) Servers

50 PinPointResults Probing Budget Restricted probing budget experiment Commercial Node Dataset -211 end hosts, 200 landmarks, 20 monitors

51 PinPointResults Exhaustive data experiment Commercial Node Dataset -211 end hosts, 200 landmarks, 20 monitors, Probing Budget of 200 Methodology PinPoint Octant IP2Location MaxMind Mean Error (in miles) Median Error (in miles)

52 PinPointConclusions Using existing Internet infrastructure with known location we can enhance geolocation performance Through the use of a novel Sparse Embedding algorithm we are able to cluster end hosts in areas of population density without explicitly defined data. Performance in terms of Mean error shows: Over 70 mile improvementover state-of-the-art measurement-based method. Almost 400 mile improvementover commercial IP geolocation database.

53 Questions?

54 PinPointOverview Consider geolocation of a single end host Probing load of obtaining measurements to all known landmarks is likely infeasible. Through either the inability to probe from the end host/landmarks or time constraints Instead we consider the use of a small set of monitors. End hosts we have control over and know their geolocation

55 Latency to Distance Estimation Consider the known distances and latency between landmarks and the monitors. We can generate kernel density estimate for observed measurements. Observation of latency 10-20ms

56 Latency to Distance Estimation Observation of latency 10-20ms Consider sampling from the distribution for distance estimate.

57 Bootstrap Geolocation Estimation Sparse embedding geolocation estimate using a single realization from latency-distance distributions.

58 Bootstrap Geolocation Estimation Consider multiple realizations from the latency to distance estimation for a single end host

59 Bootstrap Geolocation Estimation The center of the multiple estimates is the final PinPoint estimated geolocation PinPoint Geolocation Estimate

60 Bootstrap Geolocation Confidence If we perform 20 bootstrap realizations, the 95% empirical bootstrap confidence bounds can be found by removing the largest outlier. PinPoint Confidence Bounds

61 PinPointConfidence Intervals Commercial Node Dataset -211 end hosts, 200 landmarks, 20 monitors, Probing Budget of 20

62 PinPointResults Performance Restricted probing budget experiment Commercial Node Dataset -211 end hosts, 200 landmarks, 20 monitors

63 Sparse Embedding -Description Standard Embedding Result

64 Sparse Embedding -Description

65 Sparse Embedding -Description

66 Sparse Embedding -Description

67 Sparse Embedding Consider some landmark : If for any choice of Then our Sparse Embedding methodology will geolocation the end host at the location of landmark

68 Geolocation Monitors Known location

69 Latency Measurements 64 ms 14 ms 35 ms 19 ms

70 Latency Measurements 1 ms = 100 km in fiber 19 ms

71 Latency Measurements

72 Measurement Limitations Most Internet paths are not direct line-of-sight to destination. Madison, WI to Los Angeles, CA path Direct Line-of-Sight 2,036 miles

73 Measurement Limitations Most Internet paths are not direct line-of-sight to destination. Madison, WI to Los Angeles, CA path Direct Line-of-Sight 2,036 miles Actual Path 3,300 miles

74 Passive Measurements Monitor

75 Passive Measurements Monitor

76 Hop-based Geolocation From the Preliminary Examination Ability to cluster resources in the Internet using hop count vectors

77 Hop-based Geolocation If the end host and landmark share a common border router, then the hop count vectors:

78 Hop-based Geolocation From Chapter 3, we show that if two end hosts have a constant hop offset, then in a network-sense they are close. Hypothesis:Close in the network is equivalent to close in the geography