Xiangyang Luo

City-Level Geolocation Based on Routing Feature

For the problem that traditional approaches for IP geolocation based on delay measurement are difficult to apply to network with weak connectivity such as Chinas Internet, in this paper, we utilize its hierarchical topology and proposed an approach of City-level geolocation based on routing feature. Taking IPs with known geographical location as reference nodes, this approach extracts identifying IPs of candidate regions or cities based on decision tree learning algorithm. We match the path of the target with IPs above called identifying features, and then select the region or city whose identifying feature is contained on the targets path as geolocation result. This approach improves the average accuracy for the Internet with weak connectivity hierarchical topology to 93% vs. 73% for the previous learning-based geolocation approach.

A localization and tracking scheme for target gangs based on big data of Wi-Fi locations

The modeling and analysis of target gangs’ usual haunts plays a very important role in law enforcement and supervision. Existing localization and tracking schemes usually need to deploy a large number of monitoring devices or continue to move with the target, which lead to high cost. In this paper, a localization and tracking scheme based on big data of Wi-Fi locations is proposed. Firstly, the characteristic of the smart mobile device that continuously broadcasts probe request frames is used to obtain its MAC address and Wi-Fi connection history. Secondly, the service set identifier (SSID) in the Wi-Fi connection history of smart mobile devices held by the target gangs are queried from the Wi-Fi location database, and the target gangs’ usual haunts are gained by statistical analysis. Lastly, monitoring devices are deployed in these places, and most of the target gangs’ activity pattern are known with only a small number of monitoring devices. The results of the related experimental tests demonstrate the feasibility of the proposed scheme.

Geolocating a WeChat user based on the relation between reported and actual distance

The combination of social networks and the Internet of Things has raised a new wave of network technology application. However, the presence of malicious social network users poses a potential threat to Internet of Things security, and the research on social network user geolocation technology is of great significance. The accuracy of existing geolocation methods for WeChat users depends on the stable correspondence between the reported distance and actual distance. In view of the difficulty to pinpoint users’ location in the real world due to WeChat location protection strategy, a WeChat user geolocation algorithm based on the reported and actual distance relation analysis is proposed. The proposed algorithm selects the target reported distance and determines the initial target space based on statistical characteristics of the relation between the reported distance and actual distance. What is more, stepwise strategies are taken to improve the accuracy rate of space partition. Experimental results show that, on the premise that target users can be discovered, the proposed algorithm could achieve higher accuracy compared with the classical space partition–based algorithm and the heuristic number theory based algorithm. The highest geolocation accuracy is within 10 m and 56% of geolocation results are within 60 m.

Hydra-Bite: Static Taint Immunity, Split, and Complot Based Information Capture Method for Android Device

In order to attract attention to the malicious use of large-scale operation of applications, Hydra-Bite, an Android device privacy leak path implemented by splitting traditional malicious application and restructuring to a collaborative application group, is proposed in this paper. For Hydra-Bite, firstly, traditional privacy stealing Trojan is analyzed to obtain the permission set. And the permission set redundancy elimination splitting algorithm is subsequently adopted to extract the simplest key permission set and split the set by functions so as to form the collaborative application group. Then, a covert channel is adopted for the intergroup Apps to remove the information’s taint tagged by security methods. Meanwhile, a communication medium selection algorithm and an information normalization coding method are proposed to improve the efficiency and the concealing property for taints removal. Finally, collaborative external transmission of information is realized on the basis of intragroup Apps’ communication. The experimental results show that Hydra-Bite could resist the detecting and killing of about 60 security engines such as Kaspersky, McAfee, and Qihoo-360 in VirusTotal platform and capture the privacy information of the devices of different versions from Android 4.0 to Android 7.0. Hydra-Bite can resist the killing of the following two methods, the typical detection tool Androguard based on “permission-API” and the typical static taint tracking tool FlowDroid. Compared with traditional privacy stealing Trojan, Hydra-Bite has higher information capture rate and stronger antikilling performance.

A Network Coordinate System Constructing Algorithm Based on Optimal Neighbor Nodes

Network coordinate systems (NCS) are often used to predict network latency. For the problem that there are large errors in existing classical NCS based on selecting neighbor nodes randomly, a NCS constructing algorithm based on optimal neighbor nodes is proposed. The algorithm firstly builds the NCS by randomly selecting neighbor nodes and calculate the prediction delay corresponding to different neighbor nodes. Secondly, the relative error of the NCS is calculated according to prediction delay and measured delay. Thirdly, the neighbor nodes with the smallest relative error are selected as the optimal neighbor nodes. Lastly, the coordinates of unknown nodes are determined using the optimal neighbor nodes. Experimental results based on PlanetLab nodes show that the prediction delay of proposed algorithm is more accurate compared with that of the NCS constructed by selecting neighbor nodes randomly.

A WeChat User Geolocating Algorithm Based on the Relation Between Reported and Actual Distance

The accuracy of existing geolocation methods for WeChat users depends on the stable correspondence between reported distance and actual distance. In view of the difficulty to pinpoint users’ location in real-world due to WeChat location protection strategy, a WeChat User geolocating Algorithm based on reported and actual distance relation analysis is proposed. Firstly, statistical characteristics of the relation between reported distance and actual distance are obtained based on collected data. Secondly, optimization parameters are selected based on these characteristics to determine the space where the target user is located. Finally, stepwise strategies are taken to improve the accuracy rate of space partition. Experimental results show that, on the premise that target users can be discovered, the proposed algorithm could achieve higher accuracy compared with the classical space partition based algorithm and the heuristic number theory based algorithm. The highest geolocating accuracy is within 10 m and 56% of geolocation results are within 60 m.

IP Geolocation Base on Local Delay Distribution Similarity

IP geolocation technology can be used to obtain the real-time locations of target Internet hosts especially mobile computers, which can help law enforcement to quickly get the criminal evidence or arrest criminals. Among existing numerous geolocation methods, SLG (Street-Level Geolocation) method can achieve geolocation result with relative higher precision for a target host. However, the geolocation accuracy will be significantly reduced once the common routers that play an important role in geolocation are anonymous, which often happens in paths detection. To solve this problem, this paper proposes an IP geolocation algorithm base on local delay distribution similarity. Firstly, the target’s location at city-level granularity is obtained based on traditional SLG method. Secondly, the landmarks connected with the target by common routers are found out by topology analysis. The target’s local delay between the nearest common router and the target is gained by multi-measurement and calculation, so do the landmarks’. Thirdly, their local delay distribution is obtained by statistical analysis. Lastly, the landmark whose local delay distribution is the most similar with the target’s is selected as the estimated location of the target. Experimental results show that the proposed algorithm obviously improves the geolocation accuracy compared with traditional SLG when the common routers are anonymous.

An Algorithm of City-Level Landmark Mining Based on Internet Forum

Density and accuracy of network entity landmarks are an important foundation of IP geolocation. For the existing problems of the limited quantity and low reliability of landmarks mined by current landmark mining methods, an algorithm of city-level landmark mining based on Internet forum is proposed in this paper. Firstly, the basic principle of Web-Based landmark mining methods and their existing flaws are analyzed, and then according to existing a huge amount of individual IP addresses in the Internet forums, a technical framework of network entity landmark mining based on the Internet forum is given, Next, the Internet forum selection strategy, IP addresses extraction, IP addresses screening and other major processing steps are described respectively for two major parts of the framework, including landmark extraction algorithm and landmark evaluation algorithm. The classic GeoTrack, a network entity geolocation algorithm, is improved and used for evaluating the candidate landmarks. Finally, the feasibility of our framework and algorithm are studied from 2 aspects: forum selection strategy, and Forum-Based landmark mining algorithm. Experimental results based on 27 Internet forums of 3 types forums in 3 cities show that compared with the classic Web-Based landmark mining methods, the proposed algorithm can not only mine huge amounts of city-level landmarks, but also improve the city-level network entity geolocation accuracy obviously.

Towards region-level IP geolocation based on the path feature

While the delay-distance correlation among nodes is weak, calculating the distance constraints according to delay may fail to geolocate the target into a right region. Aiming at this problem, a new geolocation method is proposed in this paper, and according to extract path features for all possible regions in use of a large number of landmarks, this method can estimate the region for a target IP. The experiment results shown that, the proposed method can give the geolocation region with high accuracy.

A Landmark Calibration Based IP Geolocation Approach

Aiming at the existing IP geolocation approaches does not consider the errors of landmarks, a new geolocation approach utilized landmark calibration is proposed in this paper. At first, by assigning a deviation, the location of the landmark with low reliability is regarded as a possible area, then geolocating the target IP can be converted into a constrained optimization problem, finding the location estimation of target IP by solving this problem, as well as the real deviation of landmark. The algorithm analysis and experimental results show that, when a landmark is not located in its claimed position, our geolocation approach can still give a location for the target IP.