Biblio

Internet Protocol (IP) address holds a probative value to the identification process in digital forensics. The decimal digit is a unique identifier that is beneficial in many investigations (i.e., network, email, memory). IP addresses can reveal important information regarding the device that the user uses during Internet activity. One of the things that IP addresses can essentially help digital forensics investigators in is the identification of the user machine and tracing evidence based on network artifacts. Unfortunately, it appears that some of the well-known digital forensic tools only provide functions to recover IP addresses from a given forensic image. Thus, there is still a gap in answering if IP addresses found in a smartphone can help reveal the user’s location and be used to aid investigators in identifying IP addresses that complement the user’s physical location. Furthermore, the lack of utilizing IP mapping and visualizing techniques has resulted in the omission of such digital evidence. This research aims to emphasize the importance of geolocation data in digital forensic investigations, propose an IP visualization technique considering several sources of evidence, and enhance the investigation process’s speed when its pertained to IP addresses using spatial analysis. Moreover, this research proposes a proof-of-concept (POC) standalone tool that can match critical IP addresses with approximate geolocations to fill the gap in this area.

IP geolocation technology is widely adopted in network security, privacy protection, online advertising, etc. However, existing IP geolocation methods are vulnerable to delay inflation, which reduces their reliability and applicability, especially in weakly connected networks. To solve this problem, a ranking nodes based IP geolocation method (RNBG) is proposed. RNBG leverages the scale-free nature of complex networks to find a few important and stable nodes in networks. And then these nodes are used in the geolocation of IPs in different regions. Experimental results in China and the US show that RNBG can achieve high accuracy even in weakly connected network. Compared with typical methods, the geolocation accuracy is increased by 2.60%-14.27%, up to 97.55%.