Infer Leased IP Prefixes

This repo contains the analysis code for the IMC 2024 paper Sublet Your Subnet: Inferring IP Leasing in the Wild.

Results from paper

The 5 files named leases_[RIR]_20240401.json.gz contain the 47,318 inferred leased prefixes described in the paper. The prefixes were also annotated with RIR metadata and necesarry information to infer their lease (e.g. BGP origins as depicted in Figure 2 in the paper).

Curated reference datasets

• The leased prefixes reference dataset (positive labels) needs to be generated by RIPE.ipynb and ARIN.ipynb with the most up-to-date datasets. The registered brokers are listed in recognized_brokers_[RIR].txt
• The non-leased prefixes reference dataset is included in the files named non_lease_[ISP]_pfx.csv. They are relatively stable compared to leased prefixes.

Data Requirement

To run the code, you need to download the following CAIDA datasets:

• CAIDA AS Relationship dataset
• CAIDA AS Organizations dataset
• CAIDA Routeviews Prefix2AS dataset

and RIR WHOIS database:

• RIPE (public)

• AFRINIC (public)

• ARIN (need to sign AUP)

• APNIC (need to sign AUP)

• LACNIC (need to sign AUP)