Determining geolocation of IP addresses using user transitions over time

• US 10,298,704 B2
• Filed: 10/27/2016
• Issued: 05/21/2019
• Est. Priority Date: 10/27/2016
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Nandi, Arnab, Clark, Ryan D., Arora, Siddhartha Cingh, Gaska, Benjamin James
• Primary Examiner(s): MacIlwinen, John M
• Application Number:
  US15/336,225
• Publication Number:
  US 20180124191A1
• Time in Patent Office: 936 Days
• CPC Class Codes: G06F 16/29 Geographical information databases
• CPC Class Codes: G06F 16/9537 Spatial or temporal dependent retrieval, e.g. spatiotemporal queries
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/52 specially adapted for the location of the user terminal
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

The invention generally relates to systems and methods for determining geolocation for networks (e.g., IP addresses) for which accurate geolocation information in unknown. Various techniques are described for determining the physical location of networks by tracking user/device movement across different networks, and more particularly by tracking movement of particular users and/or devices from networks with known geolocation to networks with unknown geolocation. Aspects of the technology include using time and network address information (e.g., IP addresses) from user'"'"'s queries and merging this information with known geolocation information to create new, high quality, geolocation mappings for previously unseen networks.

Claims

1. A computerized system for mapping an unseen IP address, wherein the system comprises:

a processor; and

memory storing computerized instructions that when executed by the processor cause the processor to;

receive requests from a plurality of client computers, wherein each of the requests comprises a client ID, an IP address, and a time-stamp;

identify a plurality of user transitions, wherein each of the user transitions comprises a pair of consecutive requests, wherein both of the pair of consecutive requests are from a same client computer and wherein one request of the consecutive pair of requests is from one of a plurality of known IP addresses and the other request of the pair of consecutive requests is from the unseen IP address;

obtain geolocation information for each of the plurality of known IP networks, wherein the geolocation information comprises a pair of geographic coordinates;

determine geolocation information for the unseen IP address based on the plurality of user transitions and the geolocation information for the plurality of known networks.

2. The computerized system of claim 1, further comprising computerized instructions stored in the memory that when executed by the processor cause the processor to:

determine a weighted average geolocation prediction for the unseen IP address.

3. The computerized system of claim 2, wherein the weighted average geolocation prediction is weighted based on a count of transitions from each of the plurality of known IP addresses to the unseen IP address.

4. The computerized system of claim 2, further comprising computerized instructions stored in the memory that when executed by the processor cause the processor to:

determine an extreme geolocation prediction for the unseen IP address, wherein the extreme geolocation prediction comprises a polygon and each of the pairs of geographic coordinates for all of the known IP addresses are encompassed within the polygon.

5. A computerized method for determining a geolocation of an unseen network comprising:

identifying user transitions for a particular user, wherein each of the user transitions is between a known network and the unseen network; and

gathering geolocation information for each of a plurality of known networks that have a transition to the unseen network, wherein the plurality of known networks comprises a first known network and a second known network; and

predicting the geolocation of the unseen network based on the identified user transitions and the geolocation information for the plurality of known networks.

6. The computerized method of claim 5, further comprising:

determining a count of user transitions between the first known network and the unseen network; and

determining a count of user transitions between the second known network and the unseen network.

7. The computerized method of claim 6, wherein predicting the geolocation of the unseen network further comprises determining a weighted average geolocation prediction by:

weighting the geolocation information for the first known network by the count of user transitions between the first known network and the unseen network to create weighted geolocation information for the first known network;

weighting the geolocation information for the second known network by the count of user transitions between the second known network and the unseen network to create weighted geolocation information for the second known network;

averaging the weighted geolocation information for the first known network and the weighted geolocation information for the second known network.

8. The computerized method of claim 7, wherein predicting the geolocation of the unseen network further comprises determining an extreme geolocation prediction by identifying a plurality of extreme coordinates from the geolocation information for the first known network and the second known network.

9. The computerized method of claim 8, wherein predicting the geolocation of the unseen network further comprises:

determining a ratio by comparing the weighted average geolocation prediction to the extreme geolocation prediction; and

rejecting the weighted average geolocation prediction if the ratio exceeds a threshold.

10. The computerized method of claim 9, wherein the threshold is 4.

11. The computerized method of claim 5, wherein predicting the geolocation of the unseen network further comprises determining an extreme geolocation prediction by identifying a plurality of extreme coordinates from the geolocation information for the first known network and the second known network.

12. The computerized method of claim 5 further comprising:

identifying the particular user by a client ID.

13. The computerized method of claim 5, wherein the particular user is a particular computing device.

14. The computerized method of claim 5, wherein the particular user is a particular application on a particular computing device.

15. The computerized method of claim 5, wherein the unseen network is an IPv6 address.

16. The computerized method of claim 5, wherein the first known network is a range of IP addresses.

17. The computerized method of claim 5 wherein the geolocation information for the first known network is equal to the geolocation information for the second known network.

18. A computerized method for mapping an unseen network comprising:

creating a request log comprising a plurality of requests, wherein each request comprises a client ID, a network address, and a time stamp;

creating a user transition log based on the request log, wherein the transition log comprises a plurality of user transitions from known network to the unseen network, wherein each user transition corresponds to a pair of consecutive user requests and each of the pair of consecutive user requests is from a same client ID;

compiling geolocation information for each of the known networks that have a user transition with the unseen network, wherein the geolocation information comprises latitude and longitude coordinates for each of the known networks; and

determining geolocation information for the unseen network based on the user transition log and the geolocation information for the known networks.

19. The computerized method of claim 18 further comprising:

determining a count of transitions from each of the known networks to the unseen network; and

adding the count of transitions from each of known networks to the unseen network to the user transition log.

20. The computerized method of claim 18 further comprising:

determining a geolocation polygon for the unseen network based on a smallest latitude coordinate, a largest latitude coordinate, a smallest longitude coordinate, and the largest longitude coordinate from the geolocation information for the known networks.