CISPA
Browse
cispa_all_3362.pdf (10.72 MB)

On the Origin of Scanning: The Impact of Location on Internet-Wide Scans

Download (10.72 MB)
conference contribution
posted on 2023-11-29, 18:15 authored by Gerry Wan, Liz Izhikevich, David Adrian, Katsunari Yoshioka, Ralph Holz, Christian RossowChristian Rossow, Zakir Durumeric
Fast IPv4 scanning has enabled researchers to answer a wealth of security and networking questions. Yet, despite widespread use, there has been little validation of the methodology’s accuracy, including whether a single scan provides sufficient coverage. In this paper, we analyze how scan origin affects the results of Internet-wide scans by completing three HTTP, HTTPS, and SSH scans from seven geographically and topologically diverse networks. We find that individual origins miss an average 1.6–8.4% of HTTP, 1.5–4.6% of HTTPS, and 8.3–18.2% of SSH hosts. We analyze why origins see different hosts, and show how permanent and temporary blocking, packet loss, geographic biases, and transient outages affect scan results. We discuss the implications for scanning and provide recommendations for future studies.

History

Preferred Citation

Gerry Wan, Liz Izhikevich, David Adrian, Katsunari Yoshioka, Ralph Holz, Christian Rossow and Zakir Durumeric. On the Origin of Scanning: The Impact of Location on Internet-Wide Scans. In: ACM Internet Measurement Conference (IMC). 2020.

Primary Research Area

  • Threat Detection and Defenses

Name of Conference

ACM Internet Measurement Conference (IMC)

Legacy Posted Date

2021-02-15

Open Access Type

  • Green

BibTeX

@inproceedings{cispa_all_3362, title = "On the Origin of Scanning: The Impact of Location on Internet-Wide Scans", author = "Wan, Gerry and Izhikevich, Liz and Adrian, David and Yoshioka, Katsunari and Holz, Ralph and Rossow, Christian and Durumeric, Zakir", booktitle="{ACM Internet Measurement Conference (IMC)}", year="2020", }

Usage metrics

    Categories

    No categories selected

    Exports

    RefWorks
    BibTeX
    Ref. manager
    Endnote
    DataCite
    NLM
    DC