New AI Method Pins Down Any Internet Address to Within a Few Streets

Every device connected to the internet carries an address, and knowing where that address physically sits has become one of cybersecurity’s most stubborn problems. When investigators trace a cyberattack or analysts map criminal infrastructure, they need to convert an IP address into a geographic location without the target’s cooperation. A research team in China has now unveiled a method, called HB-Geo, that pushes street-level IP geolocation to a new standard of coverage and accuracy, succeeding where the current state of the art routinely fails. The work, published in the open-access journal Cybersecurity, demonstrates that two deceptively simple ideas—rebuilding the way machines find their network neighbors, and letting learned on-off switches filter out bad information—can deliver dramatic gains across both IPv4 and IPv6 networks.

To understand why HB-Geo matters, it helps to see how the field evolved. The earliest approaches queried commercial geolocation databases such as IP2Location, IPIP, and MaxMind, which can return an answer instantly but, for the vast majority of addresses, offer only city-level, province-level, or country-level precision. Because these databases demand constant maintenance to stay current, their accuracy also degrades over time. Data mining methods attempted to squeeze location from social media check-ins, reverse DNS hostnames, and IP clustering, but the richest data sources are locked inside large commercial companies that ordinary researchers cannot easily access. That left network measurement—the practice of actively probing the internet and analyzing delays and routing paths—as the most promising route to street-level accuracy.

Network measurement methods rely on landmarks: network devices such as servers, webcams, or Wi-Fi access points whose physical locations are already known with high confidence. By measuring round-trip delays and tracing routes between a probing server and these landmarks, a geolocation system can estimate where an unknown target IP sits relative to them. Early rule-based systems like SLG and Corr-SLG translated latency into distance using handcrafted formulas, but the relationship between delay and distance is messy and nonlinear, so accuracy suffered. Machine learning approaches such as NN-Geo and MLP-Geo learned those patterns automatically from round-trip times and traceroute paths, yet they treated networks as flat tables of numbers rather than what they truly are: graphs. The breakthrough of the past few years came from graph neural networks, which model the network directly as nodes and edges and learn how targets relate to nearby landmarks.

The most accurate graph-based techniques do not learn from the entire network graph at once. Instead, they build small subgraphs centered on each target IP, typically by finding the common last-hop router that connects the target to known landmarks. The logic is sound: internet service providers usually assign addresses behind the same last-hop router to physically nearby hosts, so a target sharing a router with a landmark is probably close to it. This subgraph strategy keeps training data small, limits noise, and slashes the memory a graphics card needs compared with full-graph methods. But it carries a hidden weakness that has plagued the field: if a target IP shares no common last-hop router with any landmark—and in real networks this happens constantly—the subgraph simply cannot be built, and the target can never be geolocated at all.

HB-Geo attacks this coverage gap head-on with hop-constrained subgraphs. Rather than requiring a shared last-hop router, the system converts all measurement data into a full network graph, searches outward from each target IP, and counts how many hops separate the target from every landmark. It then connects the target directly to the landmarks with the minimum hop count, whatever the underlying routing structure looks like. Because some landmark is always reachable, every reachable target IP ends up in a subgraph and receives geographic supervision signals—guaranteeing 100 percent geolocalizability. The authors validated the underlying assumption statistically: across Seoul, Shanghai, Paris, and Zurich, landmarks fewer hops away are significantly closer geographically, confirmed by Spearman correlations and analysis of variance, with Osaka the one city where the monotonic relationship was not statistically clear.

Coverage alone is not enough, because a subgraph stuffed with the wrong landmarks can mislead a model badly. A landmark that is topologically close in hops but geographically irrelevant injects noise into the training signal, dragging predictions away from the truth. HB-Geo’s second innovation tackles this with binary gates. Each edge in the subgraph receives a gate that can be fully open or fully closed, deciding whether the target learns from that landmark. The gates are trained jointly with the model using two competing losses: a mean-squared-error term that rewards accurate latitude-longitude predictions, and an L0-norm penalty that pushes as many gates closed as possible. Landmarks whose signals help predictions keep their gates open; noisy landmarks are silenced. Notably, the team is the first to provide a formal mathematical definition of a noisy landmark—an edge whose removal does not worsen, and typically improves, geolocation error.

Making discrete on-off gates trainable requires a mathematical workaround, since binary values cannot be optimized by gradient descent directly. The researchers borrowed the hard concrete distribution, first developed for sparse neural networks, which stretches and folds a continuous relaxation of the Bernoulli distribution so that sampled values land exactly at 0 or 1 during inference while remaining differentiable during training. Random exploration during training prevents the model from locking onto a mediocre solution early. The authors deliberately chose this estimator over alternatives like sparse graph attention networks because those methods are designed for single-graph node classification, whereas IP geolocation demands regression across many small subgraphs with low computational overhead. A single-layer graph attention network suffices for message passing, and a lightweight decoder with batch normalization outputs the predicted coordinates.

The performance gains are striking. Across five real-world datasets—Seoul with 1,979 landmarks, Osaka with 428, Shanghai with 1,270, and the IPv6 datasets Paris with 146 and Zurich with 868—HB-Geo achieved a 100 percent geolocalizability rate while cutting mean error by 0.36 to 40.17 percent and median error by 1.15 to 43.88 percent relative to state-of-the-art baselines including GNN-Geo, Graph-Geo, Trust-Geo, Ex-Geo, Neighbor-Geo, EB-Geo, and GT-Geo. The improvements were largest in Seoul and Paris, where landmark quality within subgraphs varies most and the denoising gates have the most to remove. In cumulative distribution terms, HB-Geo located 90 percent of Seoul targets within 7 kilometers, over 95 percent of Zurich IPv6 targets within 5 kilometers, and nearly all Paris IPv6 targets within 4 kilometers.

Equally important for real-world deployment is speed. Because HB-Geo shares its learned parameters across all subgraphs, it supports inductive learning: when a brand-new target IP arrives, there is no retraining. Locating a new address on the Shanghai dataset took just 1.81 seconds, whereas the full-graph transductive methods GNN-Geo and GT-Geo required 8 minutes 54 seconds and 7 minutes 13 seconds respectively to retrain. Memory consumption tells a similar story—subgraph methods stayed between roughly 530 and 740 megabytes across the standard datasets, and even on a Los Angeles dataset containing 92,804 landmarks, one of the largest publicly available, HB-Geo used only 1,599 megabytes of GPU memory while the full-graph baselines exhausted memory entirely. Total training on any of the five city datasets finished within 15 minutes.

The authors are candid about remaining limitations. MPLS tunnels hide intermediate routers from traceroute, VPNs cause measurements to terminate at gateways and can bias estimates toward the VPN’s location, and content delivery networks reuse single addresses across many cities through anycast. Adversaries who falsify landmark coordinates or tamper with routing could also poison the measurements on which all network-measurement methods depend. The team’s roadmap includes expanding subgraph perception ranges to cope with sparse landmarks, incorporating zero-trust principles to defend against manipulated data, and eventually attempting geolocation with no landmarks at all. For now, with code and datasets released openly on GitHub, HB-Geo sets a new benchmark for a capability that defenders, investigators, and network operators have long needed: knowing, quickly and reliably, where on Earth an internet address actually lives.

Subject of Research: Street-level IP geolocation using hop-constrained subgraphs and binary gate-based graph learning

Article Title: HB-Geo: a street-level IP geolocation method based on hop-constrained subgraphs and binary gates

Article References: HB-Geo: a street-level IP geolocation method based on hop-constrained subgraphs and binary gates. (n.d.). https://doi.org/10.1186/s42400-026-00644-w

Image Credits: AI Generated

DOI: 10.1186/s42400-026-00644-w

Keywords: IP geolocation, graph neural networks, HB-Geo, binary gates, hop-constrained subgraphs, cybersecurity, IPv4, IPv6, landmarks, network measurement, inductive learning, graph attention networks