Geolocation of covert communication entity is significantly important for the forensics of the crime but has significant challenges when the steganalyst locks the guilty actor IP and wants to know the physical location of the actor. This kind of post-steganalysis involves not only the stegos transmitted on the Internet but the IP package head and content. This paper presents a geolocation method for the location of the covert communication entity based on hop-hot path coding. The method estimates the location of the covert communication entity by combining the path and delay between probes and the covert communication entity IP, which improves the deficiency that similar delays do not necessarily mean close geographical locations of the IPs. Moreover, the similarity between the IPs’ paths can be measured by coding the paths between IPs and probes. The results of a series of experiments show that the median error of the proposed method is within 6.16 km using different thresholds.

中文翻译：

---

隐式通信实体在Internet上的地理位置以进行后隐式分析

隐蔽通信实体的地理位置对于犯罪的司法鉴定非常重要，但是当隐身分析员锁定有罪的演员IP并想知道该演员的实际位置时，便面临着巨大的挑战。这种后隐式分析不仅涉及在Internet上传输的隐身游戏，还涉及IP包的头部和内容。本文提出了一种基于跳-热路径编码的秘密通信实体的地理位置定位方法。该方法通过结合探针与隐蔽通信实体IP之间的路径和延迟来估计隐蔽通信实体的位置，这改善了类似延迟不一定意味着IP的地理位置接近的缺陷。此外，可以通过对IP和探针之间的路径进行编码来测量IP路径之间的相似性。