GI 2022, IEEE Global Internet Symposium, 7 November 2022, in conjunction with IEEE CloudNet 2022, Paris, France
Identifying an attacker is a key factor to mitigate ongoing attacks. To evade localization, a single compromised machine can hide for months behind millions of available residential IP proxies. Without knowing the IP address of the machine,
registration-based geolocation methods cannot be applied. Measurement-based methods have been proposed to estimate the location of a target without using its IP address. These methods use Round Trip Time (RTT) values and network speed modeling. They estimate a distance between the target and other observation points with known locations, called landmarks. However, most of these methods require additional information,
whether it is on the topology of the network or the characteristics of the landmarks.
In this paper, we present ImMuNE, a measurement-based technique which can estimate a location with only a few Round Trip Time measurements between a target and landmarks, even when some of these measures are inflated by temporary network congestion.
Leveraging a previously made measurement campaign, we present promising results based on 11 millions TCP connections collected over a period of 4 months.
Type:
Conférence
City:
Paris
Date:
2022-11-07
Department:
Sécurité numérique
Eurecom Ref:
7065
Copyright:
© 2022 IEEE. Personal use of this material is permitted. However, permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or redistribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE.
See also:
