ImMuNE: Improved Multilateration in Noisy Environments

Abstract

Identifying an attacker is a key factor to mitigate ongoing attacks. To evade localization, a single compromised machine can hide for months behind millions of available residential IP proxies. Without knowing the IP address of the machine, registration-based geolocation methods cannot be applied.Measurement-based methods have been proposed to estimate the location of a target without using its IP address. These methods use Round Trip Time (RTT) values and network speed modeling. They estimate a distance between the target and other observation points with known locations, called landmarks. However, most of these methods require additional information, whether it is on the topology of the network or the characteristics of the landmarks.In this paper, we present ImMuNE, a measurement-based technique which can estimate a location with only a few Round Trip Time measurements between a target and landmarks, even when some of these measures are inflated by temporary network congestion.Leveraging a previously made measurement campaign, we present promising results based on 11 millions TCP connections collected over a period of 4 months.

NoPASARAN: a Novel Platform for Analysing Semi-Active elements in Routes Across a Network

“…This method is based on the round-trip time difference for the packets sent from the server to the proxy and those sent to the bot itself (through a tls tunnel). A large measurement campaign validates this idea experimentally, and the data are then used in [6] by Champion et al to find a method capable of geolocating the machines involved.…”