Bamba Gueye

IP geolocation databases: unreliable?

The most widely used technique for IP geolocation consists in building a database to keep the mapping between IP blocks and a geographic location. Several databases are available and are frequently used by many services and web sites in the Internet. Contrary to widespread belief, geolocation databases are far from being as reliable as they claim. In this paper, we conduct a comparison of several current geolocation databases -both commercial and free- to have an insight of the limitations in their usability. First, the vast majority of entries in the databases refer only to a few popular countries (e.g., U.S.). This creates an imbalance in the representation of countries across the IP blocks of the databases. Second, these entries do not reflect the original allocation of IP blocks, nor BGP announcements. In addition, we quantify the accuracy of geolocation databases on a large European ISP based on ground truth information. This is the first study using a ground truth showing that the overly fine granularity of database entries makes their accuracy worse, not better. Geolocation databases can claim country-level accuracy, but certainly not city-level.

Constraint-based geolocation of internet hosts

Geolocation of Internet hosts enables a new class of location-aware applications. Previous measurement-based approaches use reference hosts, called landmarks, with a well-known geographic location to provide the location estimation of a target host. This leads to a discrete space of answers, limiting the number of possible location estimates to the number of adopted landmarks. In contrast, we propose Constraint-Based Geolocation (CBG), which infers the geographic location of Internet hosts using multilateration with distance constraints to establish a continuous space of answers instead of a discrete one. However, to use multilateration in the Internet, the geographic distances from the landmarks to the target host have to be estimated based on delay measurements between these hosts. This is a challenging problem because the relationship between network delay and geographic distance in the Internet is perturbed by many factors, including queueing delays and the absence of great-circle paths between hosts. CBG accurately transforms delay measurements to geographic distance constraints, and then uses multilateration to infer the geolocation of the target host. Our experimental results show that CBG outperforms previous geolocation techniques. Moreover, in contrast to previous approaches, our method is able to assign a confidence region to each given location estimate. This allows a location-aware application to assess whether the location estimate is sufficiently accurate for its needs

A Survey on Network Coordinates Systems, Design, and Security

During the last decade, a new class of large-scale globally-distributed network services and applications have emerged. Those systems are flexible in the sense that they can select their communication path among a set of available ones. However, ceaselessly gathering network information such as latency to select a path is infeasible due to the large amount of measurement traffic it would generate. To overcome this issue, Network Coordinates Systems (NCS) have been proposed. An NCS allows hosts to predict latencies without performing direct measurements and, consequently, reduce the network resources consumption. During these last years, NCS opened new research fields in which the networking community has produced an impressive amount of work. We believe it is now time to stop and take stock of what has been achieved so far. In this paper, we survey the various NCS proposed as well as their intrinsic limits. In particular, we focus on security issues and solutions proposed to fix them. We also discuss potential future NCS developments, in particular how to use NCS for predicting bandwidth.

Assessing the geographic resolution of exhaustive tabulation for geolocating internet hosts

Geolocation of Internet hosts relies mainly on exhaustive tabulation techniques. Those techniques consist in building a database, that keeps the mapping between IP blocks and a geographic location. Relying on a single location for a whole IP block requires using a coarse enough geographic resolution. As this geographic resolution is not made explicit in databases, we try in this paper to better understand it by comparing the location estimates of databases with a well-established active measurements-based geolocation technique. We show that the geographic resolution of geolocation databases is far coarser than the resolution provided by active measurements for individual IP addresses. Given the lack of information in databases about the expected location error within each IP block, one cannot have much confidence in the accuracy of their location estimates. Geolocation databases should either provide information about the expected accuracy of the location estimates within each block, or reveal information about how their location estimates have been built, unless databases have to be trusted blindly.

Investigating the imprecision of IP block-based geolocation

The lack of adoption of a DNS-based geographic location service as proposed in RFC 1876 has lead to the deployment of alternative ways to locate Internet hosts. The two main alternatives rely either on active probing of individual hosts or on doing exhaustive tabulation of IP address ranges and their corresponding locations. Using active measurements, we show that the geographic span of blocks of IP addresses make their location difficult to choose. Using the single location for a block of IP addresses as an estimation of the location of its IP addresses leads to significant localization errors, whatever the choice made for the location of the block. Even using as the location of a block the one that minimizes the global localization error for all its IP addresses leads to large errors. The notion of the geographic span of a block of IP addresses is fuzzy, and depends in practice very much on the uncertainty associated to the location estimates of its IP addresses.

Leveraging buffering delay estimation for geolocation of internet hosts

Geolocation techniques aim at determining the geographic location of an Internet host based on its IP address. Currently, measurement-based geolocation techniques disregard the buffering delays that may be introduced at each hop along the path taken by probe packets. To fill this gap, we propose the GeoBuD (Geolocation using Buffering Delay estimation) approach. Although the network delay and the geographic distance between two Internet hosts have been shown to be related to some extent, leveraging buffering delay estimation at each hop for geolocation purposes is challenging for two reasons. First, correctly estimating the buffering delay at intermediate hops along a traceroute path for geolocation purposes depends on the accurate estimation of the geolocation of the intermediate routers. Second, even given an a priori knowledge of the location of the routers, estimating the buffering delays is difficult due to the coarse-grained information provided by delay measurements. Relying on traceroute measurements, we show that leveraging buffering delay estimation improves accuracy in the measurement-based geolocation of Internet hosts as well as the confidence that the geolocation service associates to each estimation.

A Deterministic Key Management Scheme for Securing Cluster-Based Sensors Networks

The main goal of Cluster-based sensor networks is to decrease system delay and reduce energy consumption. LEACH is a cluster-based protocol for micro sensor networks which achieves energy-efficient, scalable routing and fair media access for sensor nodes. However, the election of a malicious or compromised sensor node as the cluster head is one the most significant breaches in cluster-based wireless sensor networks. We propose a deterministic key management scheme, called DKS-LEACH, to secure LEACH protocol against malicious attacks. Our contributions are twofold. Firstly, we design and performed a theoretical evaluation of our security model which secures the setup and study phases of LEACH protocol. Secondly, using the TOSSIM simulator, we performed an evaluation of the power consumption of DKS-LEACH. The results indicate clear advantages of our approach in preventing the election of untrustworthy cluster head as well different kind of attacks from malicious sensor nodes.

An optimized and power savings protocol for mobility energy-aware in wireless sensor networks

Mobility management in Wireless Sensor Networks (WSNs) is a complex problem that must be taken into account in all layers of the protocol stack. But this mobility becomes very challenging at the MAC level in order to do not degrade the energy efficiency between sensor nodes that are in communication. However, among medium access protocols, sampling protocols reflect better the dynamics of such scenarios. Nevertheless, the main problem, of such protocols, remains the management of collisions and idle listening between nodes. Previous approaches like B-MAC and X-MAC, based on sampling protocols present some shortcomings. Therefore, we address the mobility issue of WSNs that use as medium access sampling protocols.Firstly, we propose a mobile access solution based on the X-MAC protocol which remains a reference protocol. This protocol, called MoX-MAC, incorporates different mechanisms that enables to mitigate the energy consumption of mobile sensor nodes. Furthermore, we extend our former work (Ba et al. in Proc. of IEEE WMNC, 2011) by evaluating the lifetime of static nodes with respect to MoX-MAC protocol, as well determine the degree of depletion of static nodes due to the presence of mobile nodes.

A Self-Organized Clustering Scheme for Overlay Networks

Hierarchical approaches, where nodes are clustered based on their network distances, have been shown to allow for robust and scalable topology-aware overlays. Moreover, recent research works have shown that cluster-based deployments of Internet Coordinates Systems (ICS ), where nodes estimate both intra-cluster and inter-cluster distances, do mitigate the impact of Triangle Inequality Violations (TIVs ) on the distance predictions, and hence offer more accurate internet latency estimations. To allow the construction of such useful clusters we propose a self-organized distributed clustering scheme. For better scalability and efficiency, our algorithm uses the coordinates of a subset of nodes, known by running an ICS system, as first approximations of node positions. We designed and evaluated two variants of this algorithm. The first one, based on some cooperation among nodes, aims at reducing the expected time to construct clusters. The second variant, where nodes are selfish, aims at reducing the induced communication overhead.

Detecting Triangle Inequality Violations for Internet Coordinate Systems

Internet Coordinate Systems (ICS) have been pro- posed as a method for estimating delays between hosts without direct measurement. However, they can only be accurate when the triangle inequality holds for Internet delays. Actually Triangle Inequality Violations (TIVs) are frequent and are likely to remain a property of the Internet due to routing policies or path inflation. In this paper we propose methods to detect TIVs with high confidence by observing various metrics such as the relative estimation error on the coordinates. Indeed, the detection of TIVs can be used for mitigating their impact on the ICS itself, by excluding some disturbing nodes from clusters running their own ICS, or more generally by improving their neighbor selection mechanism. Index Terms—Internet delay measurements, Internet Coordi- nate Systems, Performance, Triangle inequality violations.