发表机构
Johns Hopkins University; New York University（约翰斯·霍普金斯大学; 纽约大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本研究提出一种反应式IP地理定位方法，通过监听并响应互联网扫描获取RTT测量，实现主机定位，并验证其有效性与准确性。
AI 中文摘要
主动IP地理定位技术依赖于互联网主机的响应性，而被动技术则依赖于采用不均且易过时、易出错的数据源。在这项工作中，我们通过在地理分布的一组观察点监听未经请求的互联网扫描，反转了主动IP地理定位问题。通过反应式地完成与这些扫描器的连接，我们从可能原本无响应的主机获取往返时间（RTT）测量值，并将这些测量值用于地理定位。在2026年8月的20天里，我们记录了来自289,746个不同扫描器的4,680万次扫描，每次扫描都有一个反应式RTT。我们表明，反应式RTT与通过发送主动探测获得的RTT一致，990,204对测量值中超过四分之三的差异最多为10毫秒。在产生反应式RTT的扫描器中，超过一半未回答我们的主动探测，突显了我们方法的价值。我们展示了仅使用反应式RTT对56,112个不同IP地址进行多边定位的可行性。最后，利用光速约束，我们驳斥了6,852个地址的商业地理定位声明。
英文摘要
Active IP geolocation techniques rely on the responsiveness of Internet hosts, while passive techniques depend on data sources that are unevenly adopted and prone to staleness and error. In this work, we invert the active IP geolocation problem by listening at a geographically distributed set of vantage points for unsolicited Internet scans. By reactively completing connections with these scanners, we obtain round-trip time (RTT) measurements from hosts that may otherwise be unresponsive and use those measurements for geolocation. Over the course of 20 days in August 2026, we recorded 46.8 million scans from 289,746 distinct scanners, with a reactive RTT for each scan. We show that reactive RTTs align with those obtained by sending active probes, with more than three-quarters of 990,204 measurement pairs differing by at most 10 ms. Over half of the scanners that yielded a reactive RTT did not answer our active probes, highlighting the value of our approach. We demonstrate the feasibility of multilateration using purely reactive RTTs for 56,112 distinct IP addresses. Finally, using speed-of-light constraints, we refute commercial geolocation claims for 6,852 addresses.
CommentsAccepted to NewGeo '26
