When a node receives an invalid transaction or block, as far as I know, it bans the sender for 24 hours. However, I didn't exactly get which sender is banned. Is it the neighbor node that provides the data to this node, or is it the creator of the data (transaction or block)?
There is no way to know which node created a transaction or block, unless they publish that information themselves. Nodes should not have an identity that leaks into transaction or block data.
So banning for relaying invalid blocks or transactions always applies to the peer that gave you the information, based on their IP address. The protocol requires you to validate information before relaying, so you are in violation whenever you pass on invalid data.