HB-Geo: a street-level IP geolocation method based on hop-constrained subgraphs and binary gates

Abstract IP geolocation technique determines the geographic location of a target network device based on its IP address, which gives it significant application value in the field of cybersecurity for services such as cyber attack traceback and cybercrime tracking. Client-independent IP geolocation technology can obtain a user’s geographic location without requiring active user cooperation. The current state-of-the-art client-independent IP geolocation methods are based on graph learning. In particular, subgraph-based IP geolocation methods have demonstrated significant advantages. However, these methods face two major challenges: (1) if there is no common last-hop router between the target and landmarks, an IP subgraph cannot be constructed, leading to the failure of geolocating some target IPs; (2) the constructed IP subgraphs often contain noisy landmarks, resulting in degraded geolocation accuracy. To address these issues, we propose an IP geolocation method based on hop-constrained subgraphs and binary gates, named HB-Geo. Specifically, we design a novel IP subgraph construction method. The hop-constrained IP subgraphs do not rely on the common last-hop routers, allowing all reachable target IPs to be included in the subgraphs, thereby ensuring successful geolocation for every reachable target IP. Furthermore, we propose a binary gate-based IP geolocation framework. This framework can filter out noisy landmarks through binary gates, enabling target IPs to learn more valuable geographical supervision signals. Experiments on five real-world IPv4/IPv6 networks demonstrate that HB-Geo successfully geolocates all target IPs, while reducing the mean error by 0.36–40.17% and the median error by 1.15–43.88%, showing significant improvements over state-of-the-art baselines.