An internet-wide view of internet-wide scanning
Zakir Durumeric, Michael Q. Bailey, J. Alex Halderman · 2014
While it is widely known that port scanning is widespread, neither the scanning landscape nor the defensive reactions of network operators have been measured at Internet scale. In this work, we analyze data from a large network tele-scope to study scanning activity from the past year, un-covering large horizontal scan operations and identifying broad patterns in scanning behavior. We present an analy-sis of who is scanning, what services are being targeted, and the impact of new scanners on the overall landscape. We also analyze the scanning behavior triggered by recent vulnerabilities in Linksys routers, OpenSSL, and NTP. We empirically analyze the defensive behaviors that orga-nizations employ against scanning, shedding light on who detects scanning behavior, which networks blacklist scan-ning, and how scan recipients respond to scans conducted by researchers. We conclude with recommendations for institutions performing scans and with implications of recent changes in scanning behavior for researchers and network operators. 1