PaperlayerView exact revision on arXiv

Source-linked AI summary

IPGeoAI: Transformer-Based Geolocation with LLM Semantic Fusion

Avinash Kadimisetty, Andy Jinqing Yu, Philip Favaloro, Wenlong Liu, Xiaolu Xiong

arXiv:2609.04559v1cs.AI

TL;DR

City-level IP geolocation is challenging because network allocations span cities and static databases have limited coverage for new, mobile, and IPv6 addresses. IPGeoAI models IPs as hierarchical sequences and fuses semantic network metadata, improving city-level accuracy over a third-party provider on the test set.

  • Problem

    City-level geolocation is difficult because IP allocations span multiple cities, while static databases have limited coverage for new IPv6 allocations and transient mobile networks.

    Source: §1 · pp. 1–2

  • Method

    IPGeoAI passively models IP addresses as hierarchical sequences with a Transformer and enriches predictions using LLM-derived semantic features.

    Source: §2.3 · p. 3, §3.3 · p. 4

  • Results

    City-level accuracy improved by 6% absolute over the third-party provider, from 30% to 36%, on the designated test set.

    Source: §5.2 · p. 7

  • Takeaways & Limitations

    The approach is presented as a scalable, generalizable solution for new and dynamic addresses where historical data is absent.

    Source: §6 · p. 8

    The current model uses batch inference and third-party country data; real-time inference and predictions across the full geographic hierarchy remain future work.

    Source: §6 · p. 8

Abstract

from arXiv · show

Accurate city-level IP Geolocation is an important enabler for the modern digital ecosystem, underpinning services ranging from local content delivery and targeting to digital rights enforcement. However, traditional heuristic and database-driven methods often struggle to resolve the complex, non-linear allocation patterns of modern network infrastructures, particularly within the exploding IPv6 address space and transient mobile networks. In this paper, we introduce IPGeoAI, a novel deep learning model architecture that reframes geolocation from a static lookup problem to a sequential modeling task. Our approach utilizes the Transformer Encoder to capture hierarchical dependencies inherent in IP subnet structures. We propose a method to resolve geographic ambiguity by integrating unstructured semantic context via a Zero-Shot LLM Feature Extraction pipeline. We utilize Large Language Models to transform raw, noisy Autonomous Systems (AS) descriptions into structured, domain-specific metadata (such as 'University' vs. 'ISP' or 'Global' vs. 'Local') via an offline pre-computation process. By fusing these semantic signals into the network via a Multi-Head Cross-Attention module, we bridge the gap between numerical network topology and real-world semantic identity. Extensive offline evaluation on a proprietary dataset spanning 200,000 cities demonstrates that IPGeoAI significantly outperforms a leading external vendor in city-level granularity. By adopting a hierarchical inference strategy that refines coarse-grained country signals, our model achieves a 6% improvement in city-level accuracy while extending coverage to 100% of the traffic. Furthermore, in large-scale online production tests, the model drove a statistically significant +0.35% improvement in our 1st-tier downstream use cases metric.

1 Introduction

City-level IP geolocation remains difficult because network allocations span cities and change over time, even as country- and region-level resolution is highly reliable. IPGeoAI treats addresses as hierarchical sequences and adds semantic network context to improve prediction beyond static lookup.

1 Introduction

  • City-level precision remains a frontier despite reliable country- or region-level resolution, because address blocks span multiple cities and mappings fluctuate over time.Changing allocations require continuous data updates to maintain predictive accuracy.Source: §1 · p. 1
  • Static lookup databases have limited coverage for new allocations, transient mobile networks, and IPv6, while active probing faces scalability, firewall, and latency-related precision limits.Machine-learning approaches using static features have also overlooked address hierarchy and organizational semantic ambiguity.Source: §1 · p. 2
  • IPGeoAI models IP addresses as hierarchical sequences and fuses offline LLM-derived Autonomous System metadata to predict locations and generalize to unseen addresses.The approach targets both known traffic and unseen network addresses.Source: §1 · p. 2
  • IPGeoAI improves on legacy heuristics and commercial providers for known traffic and generalizes better to unseen network addresses.The introduction describes this as a scalable solution for the IPv6 era.Source: §1 · p. 2

2 Related Work

Prior geolocation work spans registry databases, active measurement, and machine learning, each with limitations in accuracy, coverage, or operational scale. IPGeoAI proposes passive sequence modeling enriched with semantic features as an alternative to per-prediction probing.

2 Related Work

  • The related work groups geolocation research into static registry-based, active measurement-based, and data-mining or machine-learning approaches.These categories frame the limitations that motivate the paper's passive approach.Source: §2 · p. 2

2.1 Registry and Database-Driven Approaches

  • Registry and commercial databases provide geolocation mappings, but WHOIS inaccuracies and limited granularity leave unresolved location uncertainty.Commercial providers aggregate partner feeds, user submissions, and mining techniques, yet can lack street-level detail.Source: §2.1 · p. 2

2.2 Measurement and Topology-Based Approaches

  • Active measurement estimates location from delay, topology, landmarks, or points of presence, but machine-learning and graph-based variants still require probing infrastructure for predictions.That infrastructure adds latency overhead and scalability limits at hyperscale.Source: §2.2 · pp. 2–3

2.3 Paradigm Limitations and Our Innovation

  • IPGeoAI instead learns from passively collected IP-GPS telemetry, representing addresses as Transformer-processed hierarchical sequences and enriching predictions with LLM-derived semantic features.The paper presents this as avoiding measurement infrastructure while enabling high-precision geolocation at hyperscale.Source: §2.3 · p. 3

3 IPGeoAI Methodology

IPGeoAI reframes geolocation as passive predictive modeling, combining hierarchical IP sequences with structured semantic metadata. Its data preparation uses geographic hierarchy and temporally aggregated GPS signals, while LLMs enrich network-provider features.

3 IPGeoAI Methodology

  • IPGeoAI uses a hybrid architecture that learns structural dependencies from historical telemetry and combines IP sequence modeling with multi-modal semantic fusion.The paper presents passive prediction as an alternative to static lookup and active triangulation.Source: §3 · p. 3

3.1 Data

  • Location boundary datasets encode relationships among cities, regions, and countries, and each city receives a numerical CityID.The geographic hierarchy supports upleveling locations from city to region and country.Source: §3.1.1 · p. 3

3.1.1 Geo Hierarchy Data:

  • A trailing seven-day aggregation pools fluctuating IP-GPS observations into a stabilized day of ground truth.The window is intended to dampen transient errors and emphasize the most consistent recent location; Figure 1 identifies the GPS aggregation process.Source: §3.1.2 · p. 3, Figure 1 · p. 3

3.2 Features

  • IP-level features include publicly available ASN and connection-type information, with connection types consolidated as Mobile, Non-Mobile, or Mixed.ASN information indicates the network provider or owner associated with an IP block.Source: §3.2 · pp. 3–4
  • Because ASN and connection-type features are high dimensional, the method adds an LLM-based pipeline to extract structured semantic metadata from ASN information.Figure 2 depicts semantic feature extraction from ASN using LLMs.Source: §3.2.1 · p. 4, Figure 2 · p. 4

3.2.1 Semantic Enrichment of Network Metadata via LLMs:

  • For each ASN, a zero-shot LLM uses identifier, provider and WHOIS names, and primary country to generate a nine-dimensional metadata vector.A manual audit of 25 ASNs found 76% agreement with public registries for ASN Usage Profile and ASN Scope.Source: §3.2.1 · p. 4

3.3 Model Architecture

IPGeoAI models IP addresses as hierarchical sequences and fuses their learned representation with semantic metadata through attention. Its classification head can use a vendor-provided country signal to constrain city selection.

3.3 Model Architecture

  • The architecture combines a hierarchical IP representation with learned metadata embeddings to predict among roughly 200,000 city IDs.The task is framed as multi-class classification over global cities.Source: §3.3 · p. 4

3.3.1 Sequential IP Encoding:

  • A 16-layer Transformer processes ordered IP octets, modeling how lower-order address components depend on higher-order network prefixes.IPv4 and IPv6 sequences have lengths four and sixteen, respectively.Source: §3.3.1 · p. 4

3.3.2 Semantic Context Encoding:

  • Categorical metadata, including ASN, connection type, and LLM-derived semantic attributes, is embedded into a shared latent space as a context bank.The attributes include examples such as ASN scope and hosting status.Source: §3.3.2 · p. 4

3.3.3 Cross-Modal Attention Fusion:

  • Cross-attention uses the IP representation as the query and metadata embeddings as keys and values, dynamically weighting context before residual and layer normalization.This addresses the limitation of static concatenation when metadata relevance depends on network context.Source: §3.3.3 · p. 5

3.3.4 Classification Head:

  • The classifier filters its 100 highest-logit city candidates to the vendor-determined country, falling back to the unconstrained top prediction if none match.The country signal is used as a coarse constraint because country-level predictions are described as more reliable than city-level predictions.Source: §3.3.4 · p. 6

4 Model Serving

IPGeoAI serves location queries through a decoupled inference framework, with predictions and ASN-derived semantic features refreshed on different schedules.

4 Model Serving

  • The production system serves real-time location queries from a daily batch pipeline and is reported to improve the semantic precision of downstream location signals.The system is described as processing substantial traffic in operation.Source: §4 · p. 6
  • Daily inference processes observed IP addresses and updates a cumulative prediction repository, while ASN semantic features are refreshed weekly using an LLM.Predictions are aggregated into region- and country-level hierarchies and indexed for real-time retrieval.Source: §4 · p. 6

5 Experiments

The experiments compare IPGeoAI with commercial baselines and model variants in offline evaluation, then test its production impact. They report stronger overall city accuracy and gains in online downstream relevance, alongside trade-offs across address types and model designs.

5.1 Baseline

  • The baseline comparison uses a 3rd-party provider because alternative commercial and open-source datasets had insufficient coverage for the production traffic.The paper excluded academic machine-learning approaches from production evaluation, citing inference scalability, active-measurement dependency, and cold-start concerns.Source: §5.1 · p. 6

5.1.1 Inference Latency and Scalability.

  • IPGeoAI has O(1) inference complexity relative to network graph size, avoiding real-time neighborhood-feature retrieval for high-throughput serving.The paper contrasts this with K-layer GNN inference whose complexity scales with the queried node's neighborhood.Source: §5.1.1 · p. 6

5.1.2 Dependency on Active Measurement.

  • The proposed approach is passive: it uses the target IP address and public ASN metadata rather than active probing or a continuously updated topology graph.This avoids maintaining a massive topology graph or deploying intrusive measurement infrastructure.Source: §5.1.2 · p. 6

5.1.3 Cold Start Scenarios.

  • For cold-start addresses, the model uses hierarchical IP sequences and semantic context to generalize to unseen or isolated subnets without neighbor information.The paper also reports that GBDT implementations exceeded 256GB for approximately 200,000 classes, while the Transformer uses a 256-dimensional embedding before projecting to logits.Source: §5.1.3 · pp. 6–7, §5.1.4 · p. 7

5.2 IPGeoAI Results

  • 6% absolute improvement in City-level accuracy (30% to 36%) and 3% in Region-level accuracy (76% to 79%) versus the 3rd-party provider.The comparison uses the designated test set; Table 2 presents the accuracy comparison.Source: §5.2 · p. 7, Table 2 · p. 7
  • The 3rd-party provider retained an IPv4 City Accuracy advantage (45.01% vs 36.87%), while IPGeoAI led on IPv6 (36.46% vs 29.58%).The reported gains were constrained by the baseline country signal to evaluate city-level discrimination.Source: §5.2 · p. 7

5.3 Ablation Study

  • 36.47% recall followed sequential octet modeling at 33.36% and attention-based feature fusion at 35.7%, with LLM-derived semantic features producing the highest recall.The ablation progression also reports 31.76% for an MLP and 32.19% for a static-feature Transformer.Source: §5.3 · pp. 7–8

5.4 Online A/B Testing

  • +0.35% lift in the 1st-tier downstream use cases metric was statistically significant in a 13-day online A/B test.Users were randomly assigned to a control serving the legacy waterfall model or a treatment serving the waterfall with IPGeoAI.Source: §5.4 · p. 8

6 Conclusion and Future Work

IPGeoAI combines Transformer-based sequential modeling with semantic metadata fusion, which the authors report as central to performance on real-world and dynamic addresses. The authors identify daily batch serving and third-party country labels as boundaries for future work.

6 Conclusion and Future Work

  • The authors present IPGeoAI as a Transformer-based framework that captures the latent hierarchical structure of IP addresses.Source: §6 · p. 8
  • Multi-Head Attention Fusion of semantic metadata unlocks state-of-the-art performance and supports generalization to new and dynamic addresses where historical data is absent.The authors report that the enhanced performance translated to an improvement in their 1st-tier downstream use cases metric.Source: §6 · p. 8
  • Current inference uses daily batch updates, while real-time inference and low-latency serving remain future work.The model currently focuses on city-level precision and obtains country labels from a third-party dataset; the authors also plan to cover the hierarchy from country to zip and hyper-local tiles.Source: §6 · p. 8

A Hyperparameters and Training Details

The appendix points to complete specifications of the model configuration and optimization hyperparameters in Tables 4 and 5.

A Hyperparameters and Training Details

B Qualitative Analysis of LLM Predictions

A manual audit compared LLM-generated soft labels for sampled ASNs with ground truth from PeeringDB and manual investigation, finding 80% agreement.

B Qualitative Analysis of LLM Predictions

C Inference Logic Walkthrough

The section gives a constrained-inference walkthrough showing how an IP address is used to predict a CityID, with city names used for simplicity.

C Inference Logic Walkthrough

Scenario

IPGeoAI uses an external country signal to filter city candidates, while the model resolves the city-level location. If no top-100 candidate matches the country, the system returns the unconstrained top prediction.

Scenario

  • The system filters the model’s top-100 city predictions by the external target-country signal, then selects the highest-probability remaining candidate.The example shows the top three for simplicity; the actual K is 100.Source: Scenario · p. 9
  • In the example, the raw top prediction is Paris, France, but country filtering rejects it and selects Paris, United States at probability 0.12.Paris, France has the highest raw probability; the filtered candidate set retains Paris, United States.Source: Scenario · p. 9
  • If no city among the top 100 matches the target country, the system falls back to the unconstrained top prediction so it always returns a prediction.The example fallback is Paris, France.Source: Scenario · pp. 9–10

Related papers

This paper cites

Loading 2609.04559v1…