Industrial Networks (INs) are widespread environments where heterogeneous devices
collaborate to control and monitor physical processes. Some of the controlled processes …

Internet-wide scanning depends on a notion of liveness: does a target IP address respond to
a probe packet? However, the interpretation of such responses, or lack of them, is nuanced …

Motivation: We compare the contents of 86 Internet blacklists to provide a view of the whole
ecosystem of blocking network touch points and blacklists. We aim to formalize and evaluate …

In recent years, with the increased use of network communication, the risk of compromising
the information has grown immensely. Intrusions have evolved and become more …

Cisco's NetFlow protocol and Internet engineering task force's Internet protocol flow
information export open standard are widely deployed protocols for collecting network flow …

Background: Fast-flux is a technique malicious actors use for resilient malware
communications. In this paper, domain parking is the practice of assigning a nonsense …

Network security analysts gather data from diverse sources, from high-level summaries of
network flow and traffic volumes to low-level details such as service logs from servers and …

Domain parking is the practice of assigning a nonsense location to a fully-qualified domain
name (FQDN) when it is not in use in order to keep it ready for “live” use. This practice is …

Background: Cybersecurity has risen to international importance. Almost every organization
will fall victim to a successful cyberattack. Yet, guidance for computer security incident …

Network traffic monitoring has become fundamental to obtaining insights about a network
and its activities. This knowledge allows network administrators to detect anomalies, identify …