HMCGeo: IP Region Prediction Based on Hierarchical Multi-label Classification

School of Computer Science and Technology, Harbin Institute of Technology, Harbin, China Emails: {23b903088, zhangzhaoxin, 22s030153, li.ning, 22b303010}@stu.hit.edu.cn School of Information and Communication Engineering, Beijing University of Posts and Telecommunications, Beijing, China Email: xinran_Liu@bupt.edu.cn Abstract --Fine-grained IP geolocation plays a critical role in applications such as location-based services and cybersecurity. Most existing fine-grained IP geolocation methods are regression-based; however, due to noise in the input data, these methods typically encounter kilometer-level prediction errors and provide incorrect region information for users. T o address this issue, this paper proposes a novel hierarchical multi-label classification framework for IP region prediction, named HMCGeo. This framework treats IP geolocation as a hierarchical multi-label classification problem and employs residual connection-based feature extraction and attention prediction units to predict the target host region across multiple geographical granularities. Furthermore, we introduce probabilistic classification loss during training, combining it with hierarchical cross-entropy loss to form a composite loss function. IP region prediction experiments on the New Y ork, Los Angeles, and Shanghai datasets demonstrate that HMCGeo achieves superior performance across all geographical granularities, significantly outperforming existing IP geolocation methods. P geolocation is a technique used to predict the geographical location of a host based on its IP address [1], playing a crucial role in location-based services, network topology optimization, and cybersecurity [2], [3], [4], [5], [6], [7], [8]. Using IP geolocation technology, online services and applications infer the geographical location of users to deliver localized weather updates, news, and event notifications [3]. Internet service providers (ISPs) estimate the approximate location of target hosts to optimize traffic transmission paths, reduce network latency, and improve transmission efficiency [4]. Network analysts examine the geographical origins of incoming traffic to assess security threats from suspicious addresses. This research was supported by the National Key R&D Program of China (2024QY1103, 2018YFB18002). Based on the accuracy of prediction results, IP geolocation is categorized into coarse-grained and fine-grained geolocation. Coarse-grained IP geolocation predicts the location of a target host by utilizing allocation information such as Autonomous System Numbers (ASN), ISP, and BGP, or by analyzing the relationship between latency and distance. These methods construct geolocation databases that provide location information at the country or city level. Building on this foundation, fine-grained IP geolocation reduces prediction errors to a few kilometers in certain regions by leveraging richer landmarks or employing more effective prediction methods.