TOWARD UNDERSTANDING THE LONGITUDINAL STABILITY OF AN IP GEOLOCATION DATABASE

Abstract

While many IP Geolocation Database (IPGD) studies exist gauging "accuracy" by comparing to ground truth (and other IPGDs), there is a dearth of studies looking at the stability of IPGD locations in longitudinal context. Here, we build a framework for such a study and apply it to MaxMind's GeoLiteCity (GLC) IPGD. We discover that there are indeed dynamic and anomalous behaviors in IPGD location histories that affect the stability of reported IP Geolocations (IPGs) over time. While only one IPGD is utilized in this study, we believe these findings will provide general insights into the construction and use of IPG data. The framework we developed quantifies dynamic behaviors (cycles, jumps, blinks, etc.) and redefines Paxson's "persistence" and "prevalence" metrics in the context of IPGDs. Applying our framework to the corpus found, for example, that of the 27,672,206 measurable network IP addresses in the corpus, 75% moved (jumped) on average nearly twice a year and 81% subsequently returned (cycled) back to where they started. Further, nearly 20% of the corpus exhibits 3 to 12 of these cycles over the 9.5 years of corpus history. We also demonstrate the utility of our framework to provide contextual insights in IPGDs by evaluating filtered subsets of the data (i.e., by Autonomous System type and by IPG continent). Lastly, we illustrate that dynamic IPGD location histories could have affected prior academic work and identify future work to expand our proposed framework.