Abstract—This paper presents a unified geospatial analysis framework of Internet Protocol (IP) addresses for Intelligence Gathering (IG). Geospatial analysis is the exploitation and analysis of imagery and location-based activities on earth. Internet connected devices have IP addresses that can be resolved to a geographic location. The IP addresses have metadata which includes location, registry and network information, Autonomous System and Internet Service Provider. These IP address records are maintained by different service organizations. Using separate services to get an IP address information is not effective. Since data is dispersed in different datasets, integration work is important for detailed analysis. By compiling different services and applying integration and analysis techniques, this paper aims to provide a unified framework and approach that can be used by security analysts for the purpose of IP address intelligence gathering and network traffic analysis. The geospatial analysis framework proposed in this paper or IPIG, is composed of IP address search engine, geospatial computations, IP similarity measurement and geo mapping techniques. IPIG is designed to handle multiple datasets and services and is validated via a test application. Using IPIG provides an improved way of IP address intelligence gathering for both technical and non-technical users.

Index Terms—Geospatial intelligence, IP address, IP locator, GeoIP, IP similarity, IP search, network traffic analysis, intelligence gathering, mapping.

The authors are with The Beacom College of Computer & Cyber Sciences, Dakota State University, Madison, South Dakota, USA.

Cite:Meshesha K. Cherie, Houssain Kettani, "IPIG: A Geospatial Analysis Framework for Internet Protocol Address Intelligence Gathering," International Journal of Computer and Communication Engineering vol. 8, no. 3, pp. 93-103, 2019.