Categorizing the IPv4 Address Space Based on Services Running on IPs

This study aims to categorize the service types of IP addresses based on running services. The service types can be categorized into Proxy, VPN, Cloud, CDN, and Hosting. The reason for this classification is, that by using these insights one can build better intrusion detection systems. For example, if the IP addresses of the daily users of the websites are mostly VPNs and proxies then owners can be aWare of the traffic and IP addresses of the visitors. Another advantage is one can build better IP blacklists and understand the nature of the ASNs(Some ASNs contain more VPN IPs, and some contain more cloud IPs likewise). The data gathering was done using many methods such as Internet-wide scanning, ASN data collection, and Whois data collection. By using these techniques millions of IP addresses were collected. Many well-known cloud vendors have officially published their IP addresses and this study takes these published IP ranges as the ground truth. About 130,000 IP addresses were collected as the ground truth. By merging these ground truth IPs, with the datasets which are collected by various techniques, the final ground truth IP dataset was constructed. By using this dataset the most important features were identified and trained in various machine learning models. From these trained machine learning models Random Forest Classifier was chosen as the best classmer for this classification since it achieves 94.71% of accuracy and a 95% F1 score.