The Use of European Internet Communication Properties for IP Geolocation

77 ISSN 1392–124X (print), ISSN 2335–884X (online) INFORMATION TECHNOLOGY AND CONTROL, 2016, T. 45, Nr. 1 The Use of European Internet Communication Properties for IP Geolocation Dan Komosny Brno University of Technology, Department of Telecommunications, Technicka 12, 616 00 Brno, Czech Republic, e-mail: ko[email protected]r.cz Miroslav Voznak VSB-TU Ostrava, Department of Telecommunications, 17. listopadu 15/2172, 708 33 Ostrava, Czech Republic, e-mail: miroslav[email protected] Sergey Bezzateev SUAI, Department of Technologies of Information Security, Bolshaya Morskaya 67. 190000 St.Petersburg, Russia, e-mail: [email protected] Kathiravelu Ganeshan Unitec Institute of Technology, Department of Computing, Victoria Street West, Private Bag 92025, 1142 Auckland, New Zealand, e-mail: [email protected] http://dx.doi.org/10.5755/j01.itc.45.1.11062 Abstract. IP Geolocation is a term used for finding the geographical location of an IP node. In this paper, we study the Internet communication properties and their use for client-independent Geolocation - finding the location without assistance of the node being located. We present and discuss the communication properties dependence on geographical aspects such as the geographical distance, differences between the source and destination country, and country population density and country ICT development index. For the study, we used a large set of data captured between the nodes geographically distributed across Europe. Based on the results, we propose an algorithm for a final location estimation within the delimited geographical area. The proposed algorithm improves the location accuracy when compared with the current techniques. Keywords: location; geolocation; client; independent; IP; Internet; latency; hop; measurement; population; ICT development index; PlanetLab. 1. Introduction Knowledge of location has always been a fundamental element in many research fields. With IP-based systems, we refer to the location process as IP location. In this paper, we focus on finding geographical locations, a process termed IP Geolocation. IP Geolocation is used in a large number of locationaware applications such as geomarketing and target content personalization [6], spam filtering [38], VoIP based emergency calls [31], IPTV viewer feedback services [4,30,5], resource allocation [34], fraud detection [25], and security prevention [1,16]. Client-independent IP Geolocation can be database or measurement driven. The database-driven approach is based on a mapping of the IP address ranges to the specific locations. The location accuracy depends on the granularity of the database entries and on their up- D. Komosny, M. Voznak, S. Bezzateev, K. Ganeshan 78 to-dateness because of the continual evolution of IP addresses assignments. An advantage of the databasedriven approach is the speed of location which consists of the time for sending the request to the database server, processing and reply. Database-driven approaches are only about 50 % accurate in locating nodes within a given city and about 90 % accurate in locating nodes within a given country [36,13,33,41]. Databases commonly used for Geolocation are Digital Envoy/NetAcuity, MaxMind/GeoIP, IPligence, IP2Location, HostIP, and GeoBytes (The list covers both private and public databases.). The measurement-driven approach for Geolocation is based on measuring the IP communication properties and their analysis. Latency and hop count (number of the routers along a path) are usually measured. Location accuracy is given by the commutation properties dependence on the geographical distance. The accuracy is lower as with the database-driven approach [11,8,36]. A disadvantage is a longer location time caused by the time needed for the measurements, data collection and their processing. The main advantage is the elimination of the up-todateness problem of the geolocation databases. The contribution of the paper is the following: 1) A comprehensive survey of the relation of Internet communication properties to geographical aspects. Such relations are the key for measurement-based IP Geolocation. We studied the relation in the European region by involving nodes geographically distributed across of the whole Europe. The placement of the nodes is presented together with the level of the correct position trustworthiness. We derived these levels by a comparison of the different location sources for each node. The study differs from related work by involving additional Geolocation related properties which could have an impact on the IP Geolocation accuracy. These properties are the country ICT development index and the population density. The ICT development index is published by ITU (International Telecommunication Union) and is used to measure the information society status. 2) An algorithm proposal for a final location estimation of the target being located. The algorithm is based on the analysis results and it modifies the current position selection process for the target's location within the delimited area as a product of the multilateration principle. The current approaches use the centroid of the delimited area unless other geographical constraints are used (for example city boundaries). We use another geographical point as the target's location. We decide the location based on an algorithm that incorporates a combination of the closest landmark strategy within the delimited area, the same country detection for the closest landmark, and country population density assumption. For the best results, we identified a threshold when the target's population density should be or not used for location estimation. We also work with shifting the target's location from the centroid towards a boundary-point of the delimited area. Our approach differs from other similar based on population density introduced in [9,39]. In [9], Eriksson et al. expand their algorithm by employing the probability of a target being inside a country with a specific population. Their estimation is based on a correlation of the number of routers in a specific geographic location with the population density in that location. The population is used as a weight factor in the location estimation process. In [39], Wang et al. propose a three-level Geolocation process (later discussed in the paper). The population density is there used for the closest web-based landmarks discovery within the delimited area and it takes a part in the last level of location process. The next section covers the related work. We continue with a more detailed description of the measurement-based approach in the section `Latencybased IP Geolocation'. In the section `Developed system', we introduce the developed measurement system for this work along with the ground truth dataset used. In the section `Communication properties', we describe and analyse the measurement data. We study their dependence on geographical aspects. We also present the correlation factors for each scenario where applicable. In the section `Location selection based on population density', we propose an algorithm for a final location estimation within the delimited geographical area. This section also includes an evaluation of the algorithm and its comparison with the currently used method. Finally, we conclude the paper. 2. Related work Internet monitoring and survey projects, such as ETOMIC [27], Scriptroute [37], Skitter [14], NINI [32], DIMES [35], iPlane, and NLANR AMP [26] provide an insight into the Internet's performance and its evolution over time. The most inspected communication properties are the latency, hop count, bandwidth, and routing paths. The results are mainly used by Internet service providers to solve issues dealing with routing efficiency, end-to-end networking performance, and service outages. Researchers use this knowledge in a broad range of networking research fields. An example is communication latency prediction between a pair of nodes without a real measurement [28,29]. Geographical properties of the Internet are also studied to improve IP Geolocation accuracy. In [17], Kasiviswanathan et al. studied the relationship between routing paths and geographical distance. They analysed routing paths in the US using several datasets such as Skitter and ip2location. Their finding related to IP Geolocation was that hop count is loosely related to geographical distance. Another observation was that the paths were significantly longer than the corresponding linear distance. Lakhina et al. [23] studied the geographical distribution of the The Use of European Internet Communication Properties for IP Geolocation 79 networking entities such as routers, L2 links and autonomous systems. Population density was also studied to analyse its relation with the location of routers. The used datasets were Skitter and ScanProject Mercator with the nodes distributed in the US, Europe and Japan. The outcome was that the density of the routers had a clear dependence on the population density in the economically homogeneous countries/regions. The authors also analysed the dependence of the connection between routers and geographical distance. Their finding was that 77-92 % of the L2 links had a dependence on the geographical distance. This assessment was set by choosing different distance limits for the USA (818 miles), Europe (366 miles) and Japan (116 miles). Links below these limits were considered as distance dependent. Fei et al. [10] presented latency and hop count measurements taken in the US and European countries. The results indicated large differences across the European countries. Arif [2] presented latency and hop count survey in the US. The measurements were taken using 50 PlanetLab and 68 Iplanet nodes. Based on the observation of the latency on distance relation, the author identified a positive correlation and suggested a probabilistic latency model for IP Geolocation purposes. The next finding was that hop count and geographical distance are only loosely related and, therefore, not suitable for IP Geolocation. A closer inspection showed that the same routers were used in the majority of communication within the used dataset. Relationship between hop count and latency was also studied with the finding that there was not any significant relationship which could be used for IP Geolocation. Dong et al. [7] presented an analysis of the latency on geographical distance relation as a base for a new latency-todistance calibration proposal. The authors used 81 PlanetLab nodes from the US and 90 from Europe. Based on their observations, they applied k-means clustering to group the measured latencies with similar properties. Based on this grouping, they proposed a polynomial regression model for a better mapping of communication latency on geographical distance. 3. Latency-based IP Geolocation Latency-based IP Geolocation is based on a positive correlation between communication latency and geographical distance. This dependence is used for obtaining the maximal geographical distance for a given measured latency between a pair of the IP nodes. The maximal distance is then used to find the location of the node. Each latency-based IP Geolocation uses a set of the landmarks with known location to measure the latency to the target - the node whose location is being estimated. The identified maximum distance from the landmark to the target is used to form a great-circle specifying the area of the possible target's location. Having a set of great-circles as a product of the measurements from the set of landmarks, multilateration is used to delimit the area of the target location as shown in Fig. 1. The figure shows a real geolocation of a node in Slovakia, Europe. Figure 1. Geolocation of target in Slovakia Latency to maximum distance conversion is calculated using static or dynamic approach. The static approach uses the value of the speed of light in a vacuum to calculate the maximum distance. The method SOI [18] calculates the maximum distance using the speed of digital information travelling in the Internet (4/9 speed of light). The speed of digital information is shown in Fig. 2 as the green line. The dynamic approach uses a calibration prior to latency measurements taken between all the landmarks with known location. Each landmark creates a set of latency points similar to Fig. 2 and then a line, which lies below all the latency points and touches the closest one, is created. The line is shown in the red colour. The method CBG [12] gives a stricter latencyto-distance conversion ratio which results in smaller great-circles around each landmark. Figure 2. SOI and CBG calibration lines Based on our previous experiments [21], only a few of the great-circles delimit the area of the target's possible location. The closest landmarks contribute the most to the delimitation. A real example of the area of the target's possible location is shown in Fig. 3. It is a common empiric rule that the estimated location is assigned to the centre-of-gravity of the delimited area. The figure shows both the real and estimated locations. D. Komosny, M. Voznak, S. Bezzateev, K. Ganeshan 80 Figure 3. Estimated area as product of Geolocation of target in Slovakia Other IP Geolocation methods are also known, such as Octant [40] or Segmented Polynomial Regression Model [7]. The first one introduces additional constraints to calculate the maximum geographical distance to the target from the landmarks. The second uses a non-linear conversion approach to follow the distribution of the latency points. Methods published in [18,19] use network topology information as additional constraints. In this paper, we focus on the dynamic latency-todistance conversion - CBG - as it forms a part of the state-of-the-art method [39]. This method uses a threelevel Geolocation process. Firstly, latency measurements from the landmarks to the target are done to delimit the target's location area. Secondly, latencies from the target to the web servers are used to bring additional target's location area constraints (the latencies are estimated, not actually measured). Thirdly, the closest web server is searched for location information to estimate the target's location. 4. Measurement system For the purpose of measuring and analysing the Internet communication properties we used more than 300 nodes belonging to the European section of PlanetLab [20] (www.planet-lab.org), which is a global experimental and research network. The developed system consists of a measurement control server, the PlanetLab nodes acting as landmarks and running the measurement application developed, the nodes acting as targets, and a data collector server. The targets we used were outside PlanetLab since we did not want to measure targets from the same network as the landmarks. In our related work [22] we noticed that using both the targets and landmarks from the same network shifts the location accuracy to better values. The reason is that communication properties are of better values when measured within the same network. However, this case does not reflect the real Geolocation applications. We gathered the targets by exploiting the DNSLOC service records. The DNSLOC service is part of the domain name system and provides a geographical location for a domain name. Despite the fact that DNSLOC service is not widely used and, therefore, unusable for practice Geolocation, it helped us to gain a number of the nodes with the known position. In total, we used around 350 nodes with the geographical distribution shown in Fig. 4. Figure 4. Position of nodes used The location was required for each node for the purpose of geographical-related analysis. For the PlanetLab nodes, we used the location information provided by the PlanetLab website. However, we found that some provided locations were incorrect as they pointed to uninhabited areas such as seas. We therefore verified each location by a comparison with other sources such as the location of university/ company owing the nodes. If we found a difference, we estimated the trustworthiness of each location as shown in Fig. 5. We applied a similar verification method to the records provided by the DNSLOC system. Figure 5. Trustworthiness of node position Figure 6. Country ICT development index The Use of European Internet Communication Properties for IP Geolocation 81 Figure 7. Country population density To process the country-specific analysis of the measured data, each node was assigned to its country. For each country, we used the ICT development index level (Fig. 6) and the population density (Fig. 7). The ICT development index levels were obtained from an ITU study published in [15]. 5. Communication properties We divided our study into several parts. Firstly, we studied the communication properties in relation to geographical distance. In this study, we worked with communication latency and hop count. Next we analysed the impact of country ICT development index and population density on latency and hop count dependence on geographical distance. 5.1. Latency dependence on distance We started with inspecting the dependence of communication latency on geographical distance. Fig. 8 shows the latencies plotted against geographical distance. We gathered around 60000 records with statistical properties summarized in Table 1. The distribution of the latencies shows a clear dependence on the geographical distance in terms of minimal latencies for a given geographical distance. Table 1. Latency statistic [s] Mean Std. dev. 1st q. Median 3rd q. 0.0208 0.0105 0.0135 0.0201 0.0269 Figure 8. Latency dependence on distance The correlation coefficient between latency and distance was identified as r = 0.78 with the linear model equal to y [ms] = 0.01173 x [km] + 6.85 (Some IP Geolocation methods are based on the linear latency-to-distance conversion, such as CBG [12]. Other methods use non-linear latency-to-distance conversion, such as Spotter or GeoWeight [24,3].). 5.2. Hop count dependence on distance Fig. 9 plots the hop count dependence on the geographical distance. Again, 60000 records were used. The statistical properties are shown in Table 2. Unlike latency, the distribution of hop count shows an unclear dependence on distance. Table 2. Hop count statistics [-] Mean Std. dev. 1st q. Median 3rd q. 14 4 12 14 16 Figure 9. Hop count dependence on distance The correlation coefficient between hop count and distance was identified as r = 0.32 with the linear model equal to y [ms] = 0.001576 x [km] + 11.97. Compared to the results presented in [17], the correlation coefficient for the US was about 0.15. This finding means that the hop count is slightly more dependent on the distance in Europe than in the US, but still is too small to make it usable for measurement-based Geolocation. The hop count might be used for finding a target's location by inspecting the number of hops from a set of landmarks. We went deeper in studying the hop count properties and tried to find whether the number of hop count can be useful in measurement-based Geolocation to estimate the distance between a landmark and target. We inspected 1 to 3 hop counts and identified the maximum geographical distances summarized in Table 3. We have to note that the presented distances are only indicative (mainly for one hop) since we did not have enough measurement data with acceptable ground truth trustworthiness. We again compared the result with the finding presented in paper [23] where the mean length of inter-domain links (a low number of hops to stay in one D. Komosny, M. Voznak, S. Bezzateev, K. Ganeshan 82 autonomous system) for Europe was 142 km. Our identified average length of the links for 3 hops was 171 km. Table 3. Maximum distances for different hop counts Hops Max. distance [km] 1 5 2 276 3 514 5.3. Country analysis We analysed communication latency in several European countries. We selected eight countries with the highest number of nodes measured. Fig. 10 shows the latency values for transmissions originated and received in the same country. The latency values are plotted with different colours for each country. The latencies of communication with the source and destination in different countries are plotted as grey and labelled as `other'. We noticed great fluctuations in Poland (blue marks) showing a large diversity with maximum latency values of 35 ms. Figure 10. Latency dependence on distance - country analysis Figure 11. Hop count dependence on distance - country analysis We analysed the hop count for the same European countries. We plotted Fig. 11 in a similar manner. However, we did not find any country-related patterns or differences. 5.3.1. ICT development index We also studied the effect of country ICT development index on latency and hop count. Fig. 12 shows the measured latencies plotted against the distance for the country ICT development index ranges. With a higher ICT index the latency values are lower and more uniform (>8, 8-7). Lower index ranges (<7) produce a higher dispersion of the measured latencies. Table 4 shows the correlation coefficients for the different ICT development indexes. The correlation coefficient is the most positive with the lowest ICT development index level. Figure 12. Latency dependence on distance – country ICT index analysis Table 4. Latency dependence on distance - country ICT index IC devel. index Correlation factor 5-6 0.87 6-7 0.78 7-8 0.68 Fig. 13 shows the same scenario for hop count. Unlike the previous analysis, we did not find any patterns between the ICT development index and hop count dependence on the distance. This confirms the previous finding about the poor relationship between hop count and distance. Figure 13. Hop count to distance - country ICT index analysis The Use of European Internet Communication Properties for IP Geolocation 83 5.3.2. Population density The country population density effect on latency dependence on distance is shown in Fig. 14. Inspecting the plot, we conclude that the latency on distance relationship is more uniform in countries with a higher population density. This is most significant for population densities larger than 150 people per km2. Table 5 shows the correlation coefficients for each population density range. The correlation coefficient decreases as population density increases. Figure 14. Latency dependence on distance - country population density analysis Table 5. Latency dependence on distance - country population density Population density Correlation factor 75-100 0.86 100-150 0.81 150-300 0.61 The effect of country population on hop count dependence on distance is shown in Fig. 15. Again, we did not find any significant patterns of relationship between population density and hop count. Figure 15. Hop count to distance - country population density analysis 6. Location selection based on population density As a use case of the communication properties analysis for IP Geolocation, we modify the selection process of the target's location within the delimited area as a product of the multilateration principle. Current approaches use the centroid of this area unless other geographical constraints are used (for example city boundaries). We use another geographical point as the target's location. For this purpose, we use the country population density. The proposed process is shown as pseudo code of Algorithm 1. The particular steps are as follows: The centroid of the delimited area is determined. Then the closest landmark from the landmarks' list is found for the target in terms of the lowest latency measured. The closest-latency landmark is checked to be inside the delimited area. Provided the landmark is inside, we assume the target and the landmark belong to the same country and we assign the population density of the target as the value stored for the landmark. Next the identified target's population density is checked against the chosen threshold. We got the best results for the threshold equal to 130 people per km2. Provided that the target's population density is below the threshold, we suggest that a less inhabited area was delimited and we set the target's location as the location of the closest-latency landmark. In this case, we assume that the landmarks are located in highly populated places, such as large cities, since they are commonly run by large companies or universities. If the density is above the threshold, we expect the delimited area to be in a highly populated country with less significant area population differences across the country. In this case we use the centroid of the delimited area as the target's location. Finally, if the closest-latency landmark is not within the delimited area boundaries, we cannot assume the target's population density. We therefore shift the target's location from the centroid towards the identified landmark. The distance for shifting is given by the delimited area's boundaries. We set the target's location as a boundary-point delimited by the direction from the area's centroid to the landmark. We implemented the algorithm in the form of a Geolocation system. Fig. 17 shows the case when the closest-latency landmark is not within the delimited area. The node location is set as the point on the area's D. Komosny, M. Voznak, S. Bezzateev, K. Ganeshan 84 border given by the direction from the centroid towards the landmark chosen. Figure 17. Estimation location within the delimited area; black cross refers to estimated location; green cross refers to correct location Table 6 shows the accuracy results after applying the algorithm. The results indicate that using only the closest-latency landmark as the target's location does not improve the accuracy. However, a combination of the latency-closest landmark and the population density gives an accuracy improvement as it decreases the median location error by 10 km compared to the CBG algorithm. Although these numbers indicate large median values, we note that the CBG algorithm is used as the first step for further refining the geolocation area as discussed earlier in the paper. The final estimation location should be used when this further refining fails due to a lack of enough landmarks available for the next processing, for example, in rural geographical areas. Table 6. Location accuracy Location estimation method Median [km] Centroid 90 Closest landmark by latency 94 Closest landmark by latency and density 80 7. Conclusion In this paper, we studied the Internet communication properties in relation to geographical aspects with a focus on Europe. Particularly we analysed latency and hop count values and their relationship on geographical distance. We also studied the effect of the static properties - country ICT development index and population density. We demonstrated the use of the obtained results by proposing an algorithm for the final estimation of the target's location. The algorithm employs information about the closest-latency landmark and the country population density. The proposed algorithm improves the location accuracy of the currently used technique for IP Geolocation. Acknowledgments Research described in this paper was financed by the National Sustainability Program under grant LO1401 and grant SGS SP2015/82. For the research, infrastructure of the SIX Center was used. References [1] V. Alarcon-Aquino, J. M. Ramirez-Cortes, P. Gomez-Gil, O. Starostenko, Y. Garcia-Gonzalez. Network Intrusion Detection Using Self-Recurrent Wavelet Neural Network with Multidimensional Radial Wavelons. Information Technology and Control, 2014, Vol. 43, No. 4, 347-358. [2] M. J. Arif. Internet host geolocation based on probabilistic latency models. The University of Melbourne, 2010, Ph.D. thesis. [3] M. J. Arif, S. Karunasekera, S. Kulkarni. GeoWeight: Internet Host Geolocation Based on a Probability Model for Latency Measurements. In: Proceedings of the Thirty-Third Australasian Conference on Computer Science. Australian Computer Society, 2010, pp. 89-98. [4] R. Burget, D. Komosny, G. Kathiravelu. Topology Aware Feedback Transmission for Real-Time Control Protocol. Journal of Network and Computer Applications, 2012, Vol. 35, No. 2, 723-730. [5] R. Burget, D. Komosny, V. Novotny. Integration of Host Position Prediction into Hierarchical Aggregation. ICN 2008: Seventh International Conference on Networking, IEEE, 2008, pp. 740-745. [6] D. Chiara, P. Giovanni, M. Sebillo, G Tortora, G. Vitiello. Geomarketing Policies and Augmented Reality for Advertisement Delivery on Mobile Devices. 17th International Conference on Distributed Multimedia Systems, Knowledge Systems Institute, 2011, pp. 78-83. [7] Z. Dong, R. Perera, R. Chandramouli, K. Subbalakshmi. Network measurement based modeling and optimization for IP geolocation. Computer Networks, 2012, Vol. 56, No. 1, 85-98. [8] B. Eriksson, P. Barford, B. Maggs, R. Nowak. Posit: An Adaptive Framework for Lightweight IP Geolocation. Boston University, 2011, BU/CS Technical Report. [9] B. Eriksson, P. Barford, J. Sommers, .R. Nowak. A learning-based approach for IP geolocation. 11th international conference on Passive and active measurement, Springer-Verlag, 2010, pp. 171-180. [10] A. Fei, G. Pei, R. Liu, L. Zhang. Measurements on Delay and Hop-Count Of The Internet. IEEE GLOBECOM'98 - Internet Mini-Conference, IEEE, 1998. [11] P. Gill, Y. Ganjali, B. Wong, D. Lie. Dude, Where's That IP? Circumventing Measurement-based IP Geolocation. 19th USENIX Security Symposium, USENIX, 2010, pp. 241-256. [12] B. Gueye, A. Ziviani, M. Crovella, S. Fdida. Constraint-based geolocation of internet hosts. IEEE/ACM Transactions on Networking, 2006, Vol. 14, No. 6, 1219-1232. [13] B. Huffaker, M. Fomenkov, K. Claffy. Geocompare: a comparison of public and commercial geolocation databases. University of California, 2011, CAIDA Tech Report. [14] B. Huffaker, D. Plummer, D. Moore, K. Claffy. Topology discovery by active probing. 2002 The Use of European Internet Communication Properties for IP Geolocation 85 Symposium on Applications and the Internet (SAINT) Workshops, IEEE, 2002, pp. 90-96. [15] IT4U. Measuring the Information Society. 2012, report. [16] Q. Jiang, J. Ma, G. Li, Z. Ma. An Improved Password-Based Remote User Authentication Protocol without Smart Cards. Information Technology and Control, 2013, Vol. 42, No. 2, 113-123. [17] S. Kasiviswanathan, S. Eidenbenz, G. Yan. Geography-based Structural Analysis of the Internet. 2010 Internet Measurement Conference, ACM, 2010. [18] E. Katz-Bassett, P. John, A. Krishnamurthy, D. Wetherall, T. Anderson, Y. Chawathe. Towards IP geolocation using delay and topology measurements. 6th ACM SIGCOMM Conference on Internet Measurement, ACM, 2006, pp. 71-84. [19] D. Komosny, J. Balej, H. Sathu, R. Shukla, P. Dolezel, M. Simek. Cable Length Based Geolocalisation. Przeglad Elektrotechniczny, 2012, (7a), pp. 26-32. [20] D. Komosny, J. Pruzinsky, P. Ilko, J. Polasek, P. Masek, O. Kocatepe. On Geographic Coordinates of PlanetLab Europe. 38th International Conference on Telecommunications and Signal Processing (TSP), IEEE, 2015, pp. 642-646. [21] D. Komosny, M. Simek, G. Kathiravelu. Can Vivaldi Help in IP Geolocation? Przeglad Elektrotechniczny, 2013, Vol. 2013, No. 5, pp. 100-106. [22] D. Komosny, M. Voznak, G. Kathiravelu, H. Sathu. Estimation of Internet Node Location by Latency Measurements - The Underestimation Problem. Information Technology and Control, 2015, Vol. 44, No. 3, 279-286. [23] A. Lakhina, J.W. Byers, M. Crovella, I. Matta. On the geographic location of Internet resources. IEEE Journal on Selected Areas in Communications, 2003, Vol. 21, No. 6, 934-948. [24] S. Laki, P. Matray, P. Haga, T. Sebok, I. Csabai, G. Vattay. Spotter: A model based active geolocation service. IEEE Conference on Computer Communications, IEEE, 2011, pp. 3173-3181. [25] MaxMind. Fraud Detection through IP Address Reputation and a Mutual Collaboration Network. 2011, white paper. [26] T. McGregor, S. Alcock, D. Karrenberg. The RIPE NCC internet measurement data repository. 11th International Conference on Passive and Active Measurement, Springer-Verlag, 2010, pp. 111-120. [27] D. Morato, et al. The European Traffic Observatory Measurement Infraestructure (ETOMIC): A testbed for universal active and passive measurements. Testbeds and Research Infrastructures for the Development of NeTworks and COMmunities, IEEE, 2005, pp. 283-289. [28] P. Moravek, D. Komosny, R. Burget, J. Sveda, T. Handl, L. Jarosova. Study and performance of localization methods in IP based networks: Vivaldi algorithm. Journal of Network and Computer Applications, 2011, 34(1), pp. 351-367. [29] P. Moravek, D. Komosny, M. Simek, J. Sveda, T. Handl. Vivaldi and other localization methods. TSP 2009: 32nd International Conference on Telecommunications and Signal Processing, Asszisztencia Congress Bureau, 2009, pp. 214-218. [30] J. Muller, D. Komosny, R. Burget. Localization of nodes for hierarchical aggregation in IPTV systems. TSP 2010: 33rd International Conference on Telecommunications and Signal Processing, Asszisztencia Congress Bureau, 2010, pp. 274-279. [31] NENA Technical Requirements Document (TRD) for Location Information to Support IP-Based Emergency Services, National Emergency Number Association (NENA) VoIP Location WG. 2006, NENA 08-752. [32] V. Paxson, A. Adams, M. Mathis. Experiences with NIMI. 2002 Symposium on Applications and the Internet (SAINT) Workshops, IEEE, 2002, pp. 108-118. [33] I. Poese, S. Uhlig, M. Kaafar, B. Donnet, B. Gueye. IP geolocation databases: unreliable? ACM SIGCOMM Computer Communication Review, 2011, 41, pp. 53-56. [34] S. Shah, et al. An Adaptive Distance-based Resource Allocation Scheme for Interdependent Tasks in Mobile Ad Hoc Computational Grids. Information Technology and Control, 2012, Vol. 41, No.4, 307-317. [35] Y. Shavitt, E. Shir. DIMES: let the internet measure itself. ACM SIGCOMM Computer Communication Review, 2005, Vol. 35, No. 5, 71-74. [36] Y. Shavitt, N. Zilberman. A Geolocation Databases Study. IEEE Journal on Selected Areas in Communications, 2011, 2(10), pp. 2044-2056. [37] N. Spring, D. Wetherall, T. Anderson. Scriptroute: A public Internet measurement facility. 4th Conference on USENIX Symposium on Internet Technologies and Systems, USENIX, 2003, pp. 225-238. [38] M. Voznak, F. Rezac. The implementation of SPAM over Internet telephony and a defence against this attack. TSP 2009: 32nd International Conference on Telecommunications and Signal Processing, Asszisztencia Congress Bureau, 2009, pp. 26-27. [39] Y. Wang, D. Burgener, M. Flores, A. Kuzmanovic, C. Huang. Towards street-level client-independent IP geolocation. 8th USENIX conference on Networked systems design and implementation, USENIX, 2011, pp. 365-379. [40] B. Wong, I. Stoyanov, E. Sirer. Octant: a comprehensive framework for the geolocalization of internet hosts. 4th USENIX conference on Networked systems design & implementation, USENIX, 2007, pp. 313-326. [41] S. Zander. How Accurate is IP Geolocation Based on IP Allocation Data? Swinburne University of Technology, 2012, Technical Report 120524A. Received March 2015.