Novel Data-Driven Geolocation Approach for Detecting Smuggled Internet Traffic

Enforcing Internet censorship in decentralised networks, such as those in India, Iraq, and Russia, poses significant challenges due to the intricate nature of their interconnected subnetworks. This paper presents a novel approach that combines Internet routing traffic analysis with IP geolocation data to identify smuggled prefixes and their associated autonomous system numbers, using Iraq as a case study. Our methodology integrates diverse datasets, including integrated autonomous system number data from IPinfo and Cloudflare Radar, Internet routing traffic from the RouteViews project, and patterns observed during periodic Internet shutdowns for national exams. By cross-referencing these data sources, we enhance the detection of smuggled autonomous system numbers and provide insights into the geographical distribution of unauthorised Internet traffic. Furthermore, the study addresses evasion techniques, such as AS-PATH prepending, and proposes collaborative strategies to improve detection accuracy. These contributions provide a scalable and robust framework for strengthening Internet governance and enhancing security in fragmented network infrastructures.