Abstract: Conventional efforts for estimating the geographic location (geolocation) of devices associated with particular Internet Protocol (IP) addresses typically yield woefully inaccurate results. In many cases, the estimated IP geolocations are on the wrong continent. Embodiments of the present technology include techniques for identifying and improving incorrect estimates based on latency measurements, Domain Name Server (DNS) information, and routing information. For example, latency measurements from multiple collectors can be used to rate the plausibility of an IP geolocation estimate and in certain cases, to increase the accuracy of the IP geolocation estimate. DNS and routing information can be used to corroborate the estimated IP geolocation. The resulting more accurate IP geolocation estimate can be used to route Internet traffic more efficiently, to enforce rules for routing sensitive information, and to simplify troubleshooting.

Abstract: Every day, thousands of routing “hijacks” occur on the Internet, almost all of them benign. The malicious ones and the resulting misdirection of Internet traffic can be identified by applying sophisticated analytics to extensive global real-time feeds of Border Gateway Protocol (BGP) routing updates. When legitimate attacks are discovered, the automated analysis may be augmented with Domain Name Service (DNS) data (to determine the likely targets), traceroute data (to determine if they represent Man-In-The-Middle exploits), interred business relationships (to understand the scope of the impacts) and even the raw BGP messages. These techniques can be used to uncover attacks against both commercial and government entities.

Abstract: Conventional efforts for estimating the geographic location (geolocation) of devices associated with particular Internet Protocol (IP) addresses typically yield woefully inaccurate results. In many cases, the estimated IP geolocations are on the wrong continent. Embodiments of the present technology include techniques for identifying and improving incorrect estimates based on latency measurements, Domain Name Server (DNS) information, and routing information. For example, latency measurements from multiple collectors can be used to rate the plausibility of an IP geolocation estimate and, in certain cases, to increase the accuracy of the LP geolocation estimate. DNS and routing information can be used to corroborate the estimated IP geolocation. The resulting more accurate IP geolocation estimate can be used to route Internet traffic more efficiently, to enforce rules for routing sensitive information, and to simplify troubleshooting.

Abstract: Conventional efforts for estimating the geographic location (geolocation) of devices associated with particular Internet Protocol (IP) addresses typically yield woefully inaccurate results. In many cases, the estimated IP geolocations are on the wrong continent. Embodiments of the present technology include techniques for identifying and improving incorrect estimates based on latency measurements, Domain Name Server (DNS) information, and routing information. For example, latency measurements from multiple collectors can be used to rate the plausibility of an IP geolocation estimate and, in certain cases, to increase the accuracy of the LP geolocation estimate. DNS and routing information can be used to corroborate the estimated IP geolocation. The resulting more accurate IP geolocation estimate can be used to route Internet traffic more efficiently, to enforce rules for routing sensitive information, and to simplify troubleshooting.

Abstract: Conventional efforts for estimating the geographic location (geolocation) of devices associated with particular Internet Protocol (IP) addresses typically yield woefully inaccurate results. In many cases, the estimated IP geolocations are on the wrong continent. Embodiments of the present technology include techniques for identifying and improving incorrect estimates based on latency measurements, Domain Name Server (DNS) information, and routing information. For example, latency measurements from multiple collectors can be used to rate the plausibility of an IP geolocation estimate and, in certain cases, to increase the accuracy of the IP geolocation estimate. DNS and routing information can be used to corroborate the estimated IP geolocation. The resulting more accurate IP geolocation estimate can be used to route Internet traffic more efficiently, to enforce rules for routing sensitive information, and to simplify troubleshooting.

Abstract: Conventional efforts for estimating the geographic location (geolocation) of devices associated with particular Internet Protocol (IP) addresses typically yield woefully inaccurate results. In many cases, the estimated IP geolocations are on the wrong continent. Embodiments of the present technology include techniques for identifying and improving incorrect estimates based on latency measurements, Domain Name Server (DNS) information, and routing information. For example, latency measurements from multiple collectors can be used to rate the plausibility of an IP geolocation estimate and, in certain cases, to increase the accuracy of the IP geolocation estimate. DNS and routing information can be used to corroborate the estimated IP geolocation. The resulting more accurate IP geolocation estimate can be used to route Internet traffic more efficiently, to enforce rules for routing sensitive information, and to simplify troubleshooting.