Today, the Internet security community largely emphasizes cyberspace monitoring for the
purpose of generating cyber intelligence. In this paper, we present a survey on darknet. The …

While it is widely known that port scanning is widespread, neither the scanning landscape
nor the defensive reactions of network operators have been measured at Internet scale. In …

Distributed Denial of Service (DDoS) attacks based on Network Time Protocol (NTP)
amplification, which became prominent in December 2013, have received significant global …

Scanning of hosts on the Internet to identify vulnerable devices and services is a key
component in many of today's cyberattacks. Tracking this scanning activity, in turn, provides …

Global IPv6 scanning has always been a challenge for researchers because of the limited
network speed and computational power. Target generation algorithms are recently …

Network telescopes or “Darknets” received unsolicited Internet-wide traffic, thus providing a
unique window into macroscopic Internet activities associated with malware propagation …

Aggressive network scanners, ie, ones with immoderate and persistent behaviors,
ubiquitously search the Internet to identify insecure and publicly accessible hosts. These …

Darknets are sets of IP addresses that are advertised but do not host any client or server. By
passively recording the incoming packets, they assist network monitoring activities. Since …

In this work we identify scanning strategies of IPv6 scanners on the Internet. We offer a
unique perspective on the behavior of IPv6 scanners by conducting controlled experiments …

Network-wide activity is when one computer (the originator) touches many others (the
targets). Motives for activity may be benign (mailing lists, content-delivery networks, and …