On the origin of scanning: the impact of location on Internet-wide scans

Gerry Wan; Liz Izhikevich; David Adrian; Katsunari Yoshioka; Ralph Holz; Christian Rossow; Zakir Durumeric

doi:10.1145/3419394.3424214

On the origin of scanning: the impact of location on Internet-wide scans

Gerry Wan, Liz Izhikevich, David Adrian, Katsunari Yoshioka, Ralph Holz, Christian Rossow, Zakir Durumeric

Design and Analysis of Communication Systems

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Academic › peer-review

34 Citations (Scopus)

355 Downloads (Pure)

Abstract

Fast IPv4 scanning has enabled researchers to answer a wealth of security and networking questions. Yet, despite widespread use, there has been little validation of the methodology's accuracy, including whether a single scan provides sufficient coverage. In this paper, we analyze how scan origin affects the results of Internet-wide scans by completing three HTTP, HTTPS, and SSH scans from seven geographically and topologically diverse networks. We find that individual origins miss an average 1.6-8.4% of HTTP, 1.5-4.6% of HTTPS, and 8.3-18.2% of SSH hosts. We analyze why origins see different hosts, and show how permanent and temporary blocking, packet loss, geographic biases, and transient outages affect scan results. We discuss the implications for scanning and provide recommendations for future studies.

Original language	English
Title of host publication	IMC '20
Subtitle of host publication	Proceedings of the ACM Internet Measurement Conference
Publisher	ACM SIGCOMM
Pages	662-679
Number of pages	18
ISBN (Electronic)	9781450381383
ISBN (Print)	978-1-4503-8138-3
DOIs	https://doi.org/10.1145/3419394.3424214
Publication status	Published - Oct 2020
Event	ACM Internet Measurement Conference, IMC 2020 - Online Duration: 27 Oct 2020 → 29 Oct 2020

Conference

Conference	ACM Internet Measurement Conference, IMC 2020
Abbreviated title	IMC
Period	27/10/20 → 29/10/20

Keywords

Cybersecurity
22/3 OA procedure

Access to Document

10.1145/3419394.3424214

3419394.3424214Final published version, 10.7 MBLicence: Taverne

Cite this

@inproceedings{0a7379eaff874ae98dd1b9fd44ad87c6,

title = "On the origin of scanning: the impact of location on Internet-wide scans",

abstract = "Fast IPv4 scanning has enabled researchers to answer a wealth of security and networking questions. Yet, despite widespread use, there has been little validation of the methodology's accuracy, including whether a single scan provides sufficient coverage. In this paper, we analyze how scan origin affects the results of Internet-wide scans by completing three HTTP, HTTPS, and SSH scans from seven geographically and topologically diverse networks. We find that individual origins miss an average 1.6-8.4% of HTTP, 1.5-4.6% of HTTPS, and 8.3-18.2% of SSH hosts. We analyze why origins see different hosts, and show how permanent and temporary blocking, packet loss, geographic biases, and transient outages affect scan results. We discuss the implications for scanning and provide recommendations for future studies.",

keywords = "Cybersecurity, 22/3 OA procedure",

author = "Gerry Wan and Liz Izhikevich and David Adrian and Katsunari Yoshioka and Ralph Holz and Christian Rossow and Zakir Durumeric",

year = "2020",

month = oct,

doi = "10.1145/3419394.3424214",

language = "English",

isbn = "978-1-4503-8138-3",

pages = "662--679",

booktitle = "IMC '20",

publisher = "ACM SIGCOMM",

note = "ACM Internet Measurement Conference, IMC 2020, IMC ; Conference date: 27-10-2020 Through 29-10-2020",

}

TY - GEN

T1 - On the origin of scanning: the impact of location on Internet-wide scans

AU - Wan, Gerry

AU - Izhikevich, Liz

AU - Adrian, David

AU - Yoshioka, Katsunari

AU - Holz, Ralph

AU - Rossow, Christian

AU - Durumeric, Zakir

PY - 2020/10

Y1 - 2020/10

N2 - Fast IPv4 scanning has enabled researchers to answer a wealth of security and networking questions. Yet, despite widespread use, there has been little validation of the methodology's accuracy, including whether a single scan provides sufficient coverage. In this paper, we analyze how scan origin affects the results of Internet-wide scans by completing three HTTP, HTTPS, and SSH scans from seven geographically and topologically diverse networks. We find that individual origins miss an average 1.6-8.4% of HTTP, 1.5-4.6% of HTTPS, and 8.3-18.2% of SSH hosts. We analyze why origins see different hosts, and show how permanent and temporary blocking, packet loss, geographic biases, and transient outages affect scan results. We discuss the implications for scanning and provide recommendations for future studies.

AB - Fast IPv4 scanning has enabled researchers to answer a wealth of security and networking questions. Yet, despite widespread use, there has been little validation of the methodology's accuracy, including whether a single scan provides sufficient coverage. In this paper, we analyze how scan origin affects the results of Internet-wide scans by completing three HTTP, HTTPS, and SSH scans from seven geographically and topologically diverse networks. We find that individual origins miss an average 1.6-8.4% of HTTP, 1.5-4.6% of HTTPS, and 8.3-18.2% of SSH hosts. We analyze why origins see different hosts, and show how permanent and temporary blocking, packet loss, geographic biases, and transient outages affect scan results. We discuss the implications for scanning and provide recommendations for future studies.

KW - Cybersecurity

KW - 22/3 OA procedure

U2 - 10.1145/3419394.3424214

DO - 10.1145/3419394.3424214

M3 - Conference contribution

SN - 978-1-4503-8138-3

SP - 662

EP - 679

BT - IMC '20

PB - ACM SIGCOMM

T2 - ACM Internet Measurement Conference, IMC 2020

Y2 - 27 October 2020 through 29 October 2020

ER -

On the origin of scanning: the impact of location on Internet-wide scans

Abstract

Conference

Keywords

Access to Document

Fingerprint

Cite this