The Aleph: Decoding Geographic Information from DNS PTR records Using Large Language Models

Aiding Network Geolocation With LLMs.

Abstract

Geolocating network devices is essential for various research areas. Yet, despite notable advancements, it continues to be one of the most challenging issues for experimentalists. One effective approach is leveraging geolocating hints in PTR records associated with network devices.

Extracting and interpreting geo-hints from these records is challenging because the labels are primarily intended for human interpretation rather than computational processing, and there is a lack of standardization across operators.

We introduce The Aleph, an approach and system for network device geolocation that utilizes information embedded in PTR records. The Aleph leverages Large Language Models (LLMs) to classify PTR records, generate regular expressions for these classes, and establish hint-to-location mapping per operator. We present results showing the applicability of using LLMs as a scalable approach to leverage PTR records for infrastructure geolocation.

The Aleph System: Three Stages

The Aleph is a three-stage system that leverages LLMs (currently implemented with OpenAI’s gpt-4-turbo) to extract and interpret geographic hints from DNS PTR records.

1. Classification

The Aleph processes a sample of PTR records and assigns them to structured classes based on naming conventions. The LLM identifies recurring patterns and outputs a taxonomy of labeled classes with representative examples.

2. Regular Expression (Regex) Generation

For each class, The Aleph generates a regular expression (regex) using a tailored, Few-Shot Learning prompt. This allows for scalable, automated parsing of large datasets.

3. Hint-to-Location Mapping

The final stage maps geo-hints to actual geographic locations, using knowledge gained in LLM training. The result is an operator-specific geolocation dictionary, accommodating differing interpretations of hints across different operators.


Citation

@inproceedings{aleph:conext,
    author = {Kedar Thiagarajan and Esteban Carisimo and 
 Fabián E. Bustamante},
    title = {The Aleph: Decoding Geographic Information from DNS PTR records Using Large Language Models},
    booktitle = {Proc. of the ACM CoNEXT},
    year = {2025},
    month = {12}
}