{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,1]],"date-time":"2026-08-01T00:24:45Z","timestamp":1785543885618,"version":"3.56.0"},"reference-count":43,"publisher":"Association for Computing Machinery (ACM)","issue":"CoNEXT1","license":[{"start":{"date-parts":[[2025,3,5]],"date-time":"2025-03-05T00:00:00Z","timestamp":1741132800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"National Science Foundation","award":["CNS-2107392 and CNS-2246475"],"award-info":[{"award-number":["CNS-2107392 and CNS-2246475"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Proc. ACM Netw."],"published-print":{"date-parts":[[2025,3,5]]},"abstract":"<jats:p>\n            Geolocating network devices is essential for various research areas. Yet, despite notable advancements, it continues to be one of the most challenging issues for experimentalists. An approach for geolocating that has proved effective is leveraging geolocating hints in PTR records associated with network devices. Extracting and interpreting geo-hints from PTR records is challenging because the labels are primarily intended for human interpretation rather than computational processing. Additionally, a lack of standardization across operators -- and even within a single operator, due to factors like rebranding, mergers, and acquisitions -- complicates the process. We argue that Large Language Models (LLMs), rather than humans, are better equipped to identify patterns in DNS PTR records, and significantly scale the coverage of tools like Hoiho. We introduce\n            <jats:italic toggle=\"yes\">The Aleph,<\/jats:italic>\n            an approach and system for network device geolocation that utilizes information embedded in PTR records.\n            <jats:italic toggle=\"yes\">The Aleph<\/jats:italic>\n            leverages LLMs to classify PTR records, generate regular expressions for these classes, and establish hint-to-location mapping per operator. We present results showing the applicability of using LLMs as a scalable approach to leverage PTR records for infrastructure geolocation.\n          <\/jats:p>","DOI":"10.1145\/3709374","type":"journal-article","created":{"date-parts":[[2025,3,6]],"date-time":"2025-03-06T12:15:54Z","timestamp":1741263354000},"page":"1-20","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":2,"title":["The Aleph: Decoding Geographic Information from DNS PTR Records Using Large Language Models"],"prefix":"10.1145","volume":"3","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-2355-7675","authenticated-orcid":false,"given":"Kedar","family":"Thiagarajan","sequence":"first","affiliation":[{"name":"Northwestern University, Evanston, IL, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0002-1622-2305","authenticated-orcid":false,"given":"Esteban","family":"Carisimo","sequence":"additional","affiliation":[{"name":"Northwestern University, Evanston, IL, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-7659-1527","authenticated-orcid":false,"given":"Fabi\u00e1n E.","family":"Bustamante","sequence":"additional","affiliation":[{"name":"Northwestern University, Evanston, IL, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2025,3,6]]},"reference":[{"key":"e_1_2_1_1_1","unstructured":"2024. World Bank Regions. https:\/\/www.worldbank.org\/en\/where-we-work"},{"key":"e_1_2_1_2_1","doi-asserted-by":"crossref","unstructured":"Yejin Bang Samuel Cahyawijaya Nayeon Lee Wenliang Dai Dan Su Bryan Wilie Holy Lovenia Ziwei Ji Tiezheng Yu Willy Chung et al. 2023. A multitask multilingual multimodal evaluation of chatgpt on reasoning hallucination and interactivity. arXiv (2023).","DOI":"10.18653\/v1\/2023.ijcnlp-main.45"},{"key":"e_1_2_1_3_1","volume-title":"Looking for hypergiants in peeringDB. ACM SIGCOMM CCR","author":"B\u00f6ttger Timm","year":"2018","unstructured":"Timm B\u00f6ttger, Felix Cuadrado, and Steve Uhlig. 2018. Looking for hypergiants in peeringDB. ACM SIGCOMM CCR (2018)."},{"key":"e_1_2_1_4_1","unstructured":"Tom B. Brown Benjamin Mann Nick Ryder Melanie Subbiah Jared D. Kaplan Prafulla Dhariwal Arvind Neelakantan Pranav Shyam Girish Sastry Amanda Askell et al. 2020. Language Models are Few-Shot Learners. Advances in Neural Information Processing Systems (2020)."},{"key":"e_1_2_1_5_1","unstructured":"CAIDA. 2019. Macroscopic Internet Topology Data Kit (ITDK). http:\/\/www.caida.org\/data\/internet-topology-data-kit\/."},{"key":"e_1_2_1_6_1","unstructured":"CAIDA. 2025. Archipelago Measurement Infrastructure Updates. https:\/\/catalog.caida.org\/details\/media\/2011_ archipelago.Accessed: 2025--1--15."},{"key":"e_1_2_1_7_1","unstructured":"Massimo Candela. 2022. geofeed-finder. https:\/\/github.com\/massimocandela\/geofeed-finder."},{"key":"e_1_2_1_8_1","volume-title":"Studying the evolution of content providers in IPv4 and IPv6 internet cores. Computer Communications","author":"Carisimo Esteban","year":"2019","unstructured":"Esteban Carisimo, Carlos Selmo, J Ignacio Alvarez-Hamelin, and Amogh Dhamdhere. 2019. Studying the evolution of content providers in IPv4 and IPv6 internet cores. Computer Communications (2019)."},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/2491159.2491163"},{"key":"e_1_2_1_10_1","volume-title":"Davison","author":"Dan Ovidiu","year":"2021","unstructured":"Ovidiu Dan, Vaibhav Parikh, and Brian D. Davison. 2021. IP Geolocation through Reverse DNS. ACM Trans. Internet Technol. (2021)."},{"key":"e_1_2_1_11_1","volume-title":"Proc. of PAM.","author":"Micah Sherr Rahel A.","year":"2024","unstructured":"Rahel A. Fainchtein1 and Micah Sherr. 2024. You can Find me Here: A Study of the Early Adoption of Geofeeds. In Proc. of PAM."},{"key":"e_1_2_1_12_1","volume-title":"How close is chatgpt to human experts? comparison corpus, evaluation, and detection. arXiv","author":"Guo Biyang","year":"2023","unstructured":"Biyang Guo, Xin Zhang, Ziyuan Wang, Minqi Jiang, Jinran Nie, Yuxuan Ding, Jianwei Yue, and Yupeng Wu. 2023. How close is chatgpt to human experts? comparison corpus, evaluation, and detection. arXiv (2023)."},{"key":"e_1_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1145\/2656877.2656879"},{"key":"e_1_2_1_14_1","unstructured":"Geoff Huston. 2014. How Big is that Network? https:\/\/labs.apnic.net\/?p=526."},{"key":"e_1_2_1_15_1","unstructured":"IANA. [n. d.]. Address and Routing Parameter Area (arpa). https:\/\/www.iana.org\/domains\/arpa. Accessed: 2024-05--13."},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2917804"},{"key":"e_1_2_1_17_1","volume-title":"Proc. of IMC.","author":"Iordanou Costas","year":"2018","unstructured":"Costas Iordanou, Georgios Smaragdakis, Ingmar Poese, and Nikolas Lautaris. 2018. Tracing Cross BorderWeb Tracking. In Proc. of IMC."},{"key":"e_1_2_1_18_1","volume-title":"Andrea Madotto, and Pascale Fung.","author":"Ji Ziwei","year":"2023","unstructured":"Ziwei Ji, Nayeon Lee, Rita Frieske, Tiezheng Yu, Dan Su, Yan Xu, Etsuko Ishii, Ye Jin Bang, Andrea Madotto, and Pascale Fung. 2023. Survey of hallucination in natural language generation. Comput. Surveys (2023)."},{"key":"e_1_2_1_19_1","unstructured":"Josh Karlin Stephanie Forrest and Jennifer Rexford. 2009. Nation-state routing: Censorship wiretapping and BGP. (2009)."},{"key":"e_1_2_1_20_1","volume-title":"Amir Pouran Ben Veyseh, Hieu Man, Franck Dernoncourt, Trung Bui, and Thien Huu Nguyen.","author":"Lai Viet Dac","year":"2023","unstructured":"Viet Dac Lai, Nghia Trung Ngo, Amir Pouran Ben Veyseh, Hieu Man, Franck Dernoncourt, Trung Bui, and Thien Huu Nguyen. 2023. Chatgpt beyond english: Towards a comprehensive evaluation of large language models in multilingual learning. arXiv (2023)."},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/3143361.3143392"},{"key":"e_1_2_1_22_1","volume-title":"Alibi Routing. In Proc. of ACM SIGCOMM.","author":"Levin Dave","year":"2015","unstructured":"Dave Levin, Yundo Lee, Luke Valenta, Zhihao Li, Victoria Lai, Cristian Lumezanu, Neil Spring, and Bobby Bhattacharjee. 2015. Alibi Routing. In Proc. of ACM SIGCOMM."},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/3355369.3355589"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/2504730.2504735"},{"key":"e_1_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/3485983.3494869"},{"key":"e_1_2_1_26_1","volume-title":"Proc. of IMC.","author":"Luckie Matthew","unstructured":"Matthew Luckie, Alexander Marder, Marianne Fletcher, Bradley Huffaker, and K. Claffy. 2020. Learning to Extract and Use ASNs in Hostnames. In Proc. of IMC."},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1145\/3497777.3498545"},{"key":"e_1_2_1_28_1","volume-title":"Geolocation Data Analysis","author":"Luckie Matthew J.","year":"2024","unstructured":"Matthew J. Luckie. 2024. Geolocation Data Analysis February 2024. https:\/\/users.caida.org\/~mjl\/rnc\/geo\/202402-geo\/.Accessed: 2025-01--15."},{"key":"e_1_2_1_29_1","unstructured":"OpenAI. 2024. OpenAI Platform: GPT-4 Documentation. https:\/\/platform.openai.com\/docs\/models\/gpt-4. Accessed: 2024-05--14."},{"key":"e_1_2_1_30_1","unstructured":"OpenAI and Josh Achiam et al. 2024. GPT-4 Technical Report. arXiv:2303.08774 [cs.CL]"},{"key":"e_1_2_1_31_1","unstructured":"OpenINTEL. 2024. OpenINTEL rDNS Dataset. https:\/\/www.openintel.nl\/data-access\/"},{"key":"e_1_2_1_32_1","doi-asserted-by":"crossref","unstructured":"Ramakrishna Padmanabhan Aaron Schulman Dave Levin and Neil Spring. 2019. Residential links under the weather. (2019).","DOI":"10.1145\/3341302.3342084"},{"key":"e_1_2_1_33_1","volume-title":"Padmanabhan and Lakshminarayanan Subramanian","author":"Venkata","year":"2001","unstructured":"Venkata N. Padmanabhan and Lakshminarayanan Subramanian. 2001. An Investigation of Geographic Mapping Techniques for Internet Hosts. In Proc. of ACM SIGCOMM."},{"key":"e_1_2_1_34_1","volume-title":"Proc. of USENIX Lisa.","author":"Periakaruppan Ram","year":"1999","unstructured":"Ram Periakaruppan and Evi Nemeth. 1999. GTrace - A Geographica traceroute tool. In Proc. of USENIX Lisa."},{"key":"e_1_2_1_35_1","volume-title":"Benoit Donnet, and Bamba Gueye.","author":"Poese Ingmar","year":"2011","unstructured":"Ingmar Poese, Steve Uhlig, Mohamed Ali Kaafar, Benoit Donnet, and Bamba Gueye. 2011. IP Geolocation Databases: Unreliable? 41, 2 (April 2011)."},{"key":"e_1_2_1_36_1","unstructured":"RIPE NCC. [n. d.]. Configuring Reverse DNS. https:\/\/apps.db.ripe.net\/docs\/Database-Support\/Configuring-Reverse- DNS\/. Accessed: 2024-05--13."},{"key":"e_1_2_1_37_1","volume-title":"German Rigau, and Eneko Agirre.","author":"Sainz Oscar","year":"2023","unstructured":"Oscar Sainz, Iker Garc\u00eda-Ferrero, Rodrigo Agerri, Oier Lopez de Lacalle, German Rigau, and Eneko Agirre. 2023. Gollie: Annotation guidelines improve zero-shot information-extraction. arXiv (2023)."},{"key":"e_1_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.23919\/TMA.2017.8002903"},{"key":"e_1_2_1_39_1","volume-title":"Yi Tay, Sebastian Ruder, Denny Zhou, et al.","author":"Shi Freda","year":"2022","unstructured":"Freda Shi, Mirac Suzgun, Markus Freitag, Xuezhi Wang, Suraj Srivats, Soroush Vosoughi, Hyung Won Chung, Yi Tay, Sebastian Ruder, Denny Zhou, et al. 2022. Language models are multilingual chain-of-thought reasoners. arXiv preprint arXiv:2210.03057 (2022)."},{"key":"e_1_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1145\/633025.633039"},{"key":"e_1_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1145\/3278532.3278551"},{"key":"e_1_2_1_42_1","volume-title":"Octant: A Comprehensive Framework for the Geolocalization of Internet Hosts.. In NSDI.","author":"Stoyanov Ivan","year":"2007","unstructured":"BernardWong, Ivan Stoyanov, and Emin Gun Sirer. 2007. Octant: A Comprehensive Framework for the Geolocalization of Internet Hosts.. In NSDI."},{"key":"e_1_2_1_43_1","volume-title":"USENIX Annual Technical Conference, General Track. 369--374","author":"Zhang Ming","year":"2006","unstructured":"Ming Zhang, Yaoping Ruan, Vivek S Pai, and Jennifer Rexford. 2006. How DNS Misnaming Distorts Internet Topology Mapping.. In USENIX Annual Technical Conference, General Track. 369--374."}],"container-title":["Proceedings of the ACM on Networking"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3709374","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3709374","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,23]],"date-time":"2025-08-23T18:41:50Z","timestamp":1755974510000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3709374"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,3,5]]},"references-count":43,"journal-issue":{"issue":"CoNEXT1","published-print":{"date-parts":[[2025,3,5]]}},"alternative-id":["10.1145\/3709374"],"URL":"https:\/\/doi.org\/10.1145\/3709374","relation":{},"ISSN":["2834-5509"],"issn-type":[{"value":"2834-5509","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,3,5]]},"assertion":[{"value":"2025-03-06","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}