Survival Analysis and Prediction Model of IP Address Assignment Duration

Abstract

IP addresses of end hosts change when they are reassigned. We apply survival analysis, which is commonly used in healthcare, on IP addresses to predict their assignment duration (their lifetime). We propose a survival parametric model based on a history of 6 years of address assignments on a worldwide scale. Our model outperforms alternative models both from short-term and long-term views. The custom modelling is also discussed as address assignment varies across Internet service providers (ISPs) and autonomous systems (ASs). A predictable address assignment duration has many applications, including source reputation, topology mapping, and geolocation. We describe a use-case in fraud prevention, where the proposed model is used as a trigger for two-factor authentication. The created dataset of addresses assignment durations is made publicly available.

GPS-Based Geolocation of Consumer IP Addresses

“…In addition to work on IP address locations, our data also shed light on the persistence of dynamically assigned IP addresses, itself an active area of analysis. Recent works using RIPE Atlas probes [16] and browser extensions [20] have found retention times on the order of days, but we observe a signi cantly slower rate of churn than observed in related contemporaneous work, suggesting that questions about the persistence of IP address assignment continues to deserve a ention.…”

“…For example, these ultra-"accurate" locations are not at residences, as one might expect for xed-line ISPs, but in parks, as is MaxMind's practice for default locations. [16,20] e share of "too-close" locations is smaller on the 2021 clusters; however, the IP address eld is populated for a lower share of those data.…”