Aiding Network Geolocation With LLMs

Geolocating network devices is essential for various research areas. Yet, despite notable advancements, it continues to be one of the most challenging issues for experimentalists. An approach for geolocating that has proved effective is leveraging geolocating hints in PTR records associated with network devices. Extracting and interpreting geo-hints from PTR records is challenging because the labels are primarily intended for human interpretation rather than computational processing. Additionally, a lack of standardization across operators — and even within a single operator, due to factors like rebranding, mergers, and acquisitions — complicates the process. We posit that Large Language Models (LLMs), rather than humans, are better equipped to identify patterns in DNS PTR records, and significantly scale the coverage of tools like Hoiho. We introduce The Aleph, an approach and system for network device geolocation that utilizes information embedded in PTR records. The Aleph leverages LLMs to classify PTR records, generate regular expressions for these classes, and establish hint-to-location mapping per operator. We present results showing the applicability of using LLMs as a scalable approach to leverage PTR records for infrastructure geolocation.

The Aleph

The Aleph Pipeline Diagram

The Aleph is a three-stage system that leverages Large Language Models (LLMs) to extract and interpret geographic hints from DNS PTR records. The diagram above illustrates its workflow. It is currently implemented with OpenAI’s gpt-4-turbo.

Step 1: Classification

In the first stage, The Aleph processes a sample of PTR records and assigns them to structured classes based on their naming conventions.

  • The LLM identifies recurring patterns in the records, such as Top-Level domain and the position within PTR records that geographic information is encoded.
  • The output is a taxonomy of labeled classes with representative examples, providing a structured way to analyze previously unstructured data.

Step 2: Regular Expression (Regex) Generation

Once classification is complete, The Aleph generates regex for each class using a tailored prompt containing example records from the class, a type of Few-Shot Learning.

  • The LLM generates a regex pattern that can systematically extract geo-hints from PTR records belonging to a class.
  • This allows for scalable, automated parsing of large datasets, significantly improving over manual rule-based methods.

Step 3: Hint-to-Location Mapping

In the final stage, The Aleph maps geo-hints to actual geographic locations.

  • The system maps identified hints to known locations using knowledge gained in LLM training.
  • If a new hint is detected, The Aleph can infer its likely location based on context within the PTR record.
  • The result is an operator-specific geolocation dictionary, allowing for differing interpretations of hints for different operators.

For a more detailed walkthrough including our prompts and outputs using PTR Records from AT&T, please visit the project website

Publications

People