{"id":"https://openalex.org/W4324125091","doi":"https://doi.org/10.1109/access.2023.3249474","title":"Detecting Coordinated Internet-Wide Scanning by TCP/IP Header Fingerprint","display_name":"Detecting Coordinated Internet-Wide Scanning by TCP/IP Header Fingerprint","publication_year":2023,"publication_date":"2023-01-01","ids":{"openalex":"https://openalex.org/W4324125091","doi":"https://doi.org/10.1109/access.2023.3249474"},"language":"en","primary_location":{"id":"doi:10.1109/access.2023.3249474","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2023.3249474","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/10005208/10054012.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://ieeexplore.ieee.org/ielx7/6287639/10005208/10054012.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5072328427","display_name":"Akira Tanaka","orcid":"https://orcid.org/0000-0002-2623-8151"},"institutions":[{"id":"https://openalex.org/I90023481","display_name":"National Institute of Information and Communications Technology","ror":"https://ror.org/016bgq349","country_code":"JP","type":"facility","lineage":["https://openalex.org/I90023481"]}],"countries":["JP"],"is_corresponding":true,"raw_author_name":"Akira Tanaka","raw_affiliation_strings":["National Institute of Information and Communications Technology, Koganei, Japan"],"raw_orcid":"https://orcid.org/0000-0002-2623-8151","affiliations":[{"raw_affiliation_string":"National Institute of Information and Communications Technology, Koganei, Japan","institution_ids":["https://openalex.org/I90023481"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068829903","display_name":"Chansu Han","orcid":"https://orcid.org/0000-0002-1728-5300"},"institutions":[{"id":"https://openalex.org/I90023481","display_name":"National Institute of Information and Communications Technology","ror":"https://ror.org/016bgq349","country_code":"JP","type":"facility","lineage":["https://openalex.org/I90023481"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Chansu Han","raw_affiliation_strings":["National Institute of Information and Communications Technology, Koganei, Japan"],"raw_orcid":"https://orcid.org/0000-0002-1728-5300","affiliations":[{"raw_affiliation_string":"National Institute of Information and Communications Technology, Koganei, Japan","institution_ids":["https://openalex.org/I90023481"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5029032117","display_name":"Takeshi Takahashi","orcid":"https://orcid.org/0000-0002-6477-7770"},"institutions":[{"id":"https://openalex.org/I90023481","display_name":"National Institute of Information and Communications Technology","ror":"https://ror.org/016bgq349","country_code":"JP","type":"facility","lineage":["https://openalex.org/I90023481"]}],"countries":["JP"],"is_corresponding":false,"raw_author_name":"Takeshi Takahashi","raw_affiliation_strings":["National Institute of Information and Communications Technology, Koganei, Japan"],"raw_orcid":"https://orcid.org/0000-0002-6477-7770","affiliations":[{"raw_affiliation_string":"National Institute of Information and Communications Technology, Koganei, Japan","institution_ids":["https://openalex.org/I90023481"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5072328427"],"corresponding_institution_ids":["https://openalex.org/I90023481"],"apc_list":{"value":1850,"currency":"USD","value_usd":1850},"apc_paid":{"value":1850,"currency":"USD","value_usd":1850},"fwci":0.9756,"has_fulltext":true,"cited_by_count":5,"citation_normalized_percentile":{"value":0.75655716,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":91,"max":98},"biblio":{"volume":"11","issue":null,"first_page":"23227","last_page":"23244"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11598","display_name":"Internet Traffic Analysis and Secure E-voting","score":0.9997000098228455,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9987999796867371,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7786285877227783},{"id":"https://openalex.org/keywords/fingerprint","display_name":"Fingerprint (computing)","score":0.7590991258621216},{"id":"https://openalex.org/keywords/botnet","display_name":"Botnet","score":0.6845728158950806},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.6810532808303833},{"id":"https://openalex.org/keywords/header","display_name":"Header","score":0.6654865741729736},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.5222378969192505},{"id":"https://openalex.org/keywords/host","display_name":"Host (biology)","score":0.48816853761672974},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4524196982383728},{"id":"https://openalex.org/keywords/port","display_name":"Port (circuit theory)","score":0.41382041573524475},{"id":"https://openalex.org/keywords/address-space","display_name":"Address space","score":0.41004782915115356},{"id":"https://openalex.org/keywords/the-internet","display_name":"The Internet","score":0.3847513794898987},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.11325830221176147},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.08871236443519592}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7786285877227783},{"id":"https://openalex.org/C2777826928","wikidata":"https://www.wikidata.org/wiki/Q3745713","display_name":"Fingerprint (computing)","level":2,"score":0.7590991258621216},{"id":"https://openalex.org/C22735295","wikidata":"https://www.wikidata.org/wiki/Q317671","display_name":"Botnet","level":3,"score":0.6845728158950806},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.6810532808303833},{"id":"https://openalex.org/C48105269","wikidata":"https://www.wikidata.org/wiki/Q1141160","display_name":"Header","level":2,"score":0.6654865741729736},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.5222378969192505},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.48816853761672974},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4524196982383728},{"id":"https://openalex.org/C32802771","wikidata":"https://www.wikidata.org/wiki/Q2443617","display_name":"Port (circuit theory)","level":2,"score":0.41382041573524475},{"id":"https://openalex.org/C144240696","wikidata":"https://www.wikidata.org/wiki/Q367204","display_name":"Address space","level":2,"score":0.41004782915115356},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.3847513794898987},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.11325830221176147},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.08871236443519592},{"id":"https://openalex.org/C119599485","wikidata":"https://www.wikidata.org/wiki/Q43035","display_name":"Electrical engineering","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C18903297","wikidata":"https://www.wikidata.org/wiki/Q7150","display_name":"Ecology","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/access.2023.3249474","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2023.3249474","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/10005208/10054012.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:dd5a8edfaef64979b99fe4b0988b076c","is_oa":true,"landing_page_url":"https://doaj.org/article/dd5a8edfaef64979b99fe4b0988b076c","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"IEEE Access, Vol 11, Pp 23227-23244 (2023)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.1109/access.2023.3249474","is_oa":true,"landing_page_url":"https://doi.org/10.1109/access.2023.3249474","pdf_url":"https://ieeexplore.ieee.org/ielx7/6287639/10005208/10054012.pdf","source":{"id":"https://openalex.org/S2485537415","display_name":"IEEE Access","issn_l":"2169-3536","issn":["2169-3536"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Access","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G3723536152","display_name":null,"funder_award_id":"JPJ000254","funder_id":"https://openalex.org/F4320325628","funder_display_name":"Ministry of Internal Affairs and Communications"}],"funders":[{"id":"https://openalex.org/F4320325628","display_name":"Ministry of Internal Affairs and Communications","ror":"https://ror.org/00vs1pz50"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4324125091.pdf","grobid_xml":"https://content.openalex.org/works/W4324125091.grobid-xml"},"referenced_works_count":52,"referenced_works":["https://openalex.org/W1680048174","https://openalex.org/W1744212210","https://openalex.org/W1801756924","https://openalex.org/W1892328580","https://openalex.org/W2017821362","https://openalex.org/W2024902563","https://openalex.org/W2073148641","https://openalex.org/W2081357650","https://openalex.org/W2117852776","https://openalex.org/W2128160875","https://openalex.org/W2131681506","https://openalex.org/W2132555912","https://openalex.org/W2166559705","https://openalex.org/W2168154523","https://openalex.org/W2343978497","https://openalex.org/W2576376563","https://openalex.org/W2613843087","https://openalex.org/W2743785144","https://openalex.org/W2744630832","https://openalex.org/W2771641736","https://openalex.org/W2783099387","https://openalex.org/W2884826434","https://openalex.org/W2890859663","https://openalex.org/W2891585364","https://openalex.org/W2916154162","https://openalex.org/W2943502243","https://openalex.org/W2947969447","https://openalex.org/W2963666064","https://openalex.org/W2981181114","https://openalex.org/W2991553767","https://openalex.org/W2998420555","https://openalex.org/W3012425390","https://openalex.org/W3034722371","https://openalex.org/W3086497842","https://openalex.org/W3087697243","https://openalex.org/W3091110052","https://openalex.org/W3099768174","https://openalex.org/W3171395508","https://openalex.org/W3203063668","https://openalex.org/W3215290469","https://openalex.org/W4207005940","https://openalex.org/W4226510704","https://openalex.org/W4242912132","https://openalex.org/W4282933757","https://openalex.org/W6607437439","https://openalex.org/W6610362903","https://openalex.org/W6634779276","https://openalex.org/W6665629407","https://openalex.org/W6677217071","https://openalex.org/W6680012447","https://openalex.org/W6681158678","https://openalex.org/W6682691769"],"related_works":["https://openalex.org/W2400358291","https://openalex.org/W1974508768","https://openalex.org/W2597807833","https://openalex.org/W4205996158","https://openalex.org/W1494299001","https://openalex.org/W2766754543","https://openalex.org/W2162068483","https://openalex.org/W2006518659","https://openalex.org/W2417667924","https://openalex.org/W4324125091"],"abstract_inverted_index":{"Adversaries":[0],"perform":[1],"port":[2,191,237],"scanning":[3,26,44,127],"to":[4,13,23,67,76,137,150,177],"discover":[5],"accessible":[6],"and":[7,40,135,142,164,199,208,235],"vulnerable":[8],"hosts":[9],"as":[10],"a":[11,19,64,89,91,95,99,103,125],"prelude":[12],"cyber":[14],"havoc.":[15],"A":[16,114],"darknet":[17,217],"is":[18],"cyberattack":[20],"observation":[21],"network":[22],"capture":[24],"these":[25,152,179],"activities":[27],"through":[28],"reachable":[29],"yet":[30],"unused":[31,224],"IP":[32,108,225],"addresses.":[33,226],"However,":[34],"the":[35,51,70,106,111,118,138,172,185,229,232],"enormous":[36],"amount":[37],"of":[38,42,82,216,231],"packets":[39,59,72],"superposition":[41],"diverse":[43],"strategies":[45],"prevent":[46],"extracting":[47],"significant":[48],"insights":[49],"from":[50,98,220],"aggregate":[52],"traffic.":[53,85],"Some":[54],"coordinated":[55,165],"scanners":[56],"disperse":[57],"probe":[58,96],"whose":[60],"TCP/IP":[61],"header":[62],"follows":[63],"unique":[65],"pattern":[66,90,104],"determine":[68],"whether":[69],"received":[71],"are":[73,80,141],"valid":[74],"responses":[75],"their":[77,201],"probes":[78],"or":[79],"part":[81],"other":[83],"background":[84],"We":[86,148,193,227],"call":[87],"such":[88],"fingerprint.":[92],"For":[93],"example,":[94],"packet":[97],"Mirai-infected":[100],"host":[101,120],"satisfies":[102],"whereby":[105],"destination":[107,190,236],"address":[109],"equals":[110],"sequence":[112],"number.":[113],"fingerprint":[115,173],"indicates":[116],"that":[117,239],"source":[119],"has":[121],"been":[122,133],"involved":[123],"in":[124],"particular":[126],"campaign.":[128],"Although":[129],"some":[130],"fingerprints":[131,160,195,211,230],"have":[132],"discovered":[134],"known":[136],"public,":[139],"there":[140],"will":[143],"be":[144],"more":[145],"undiscovered":[146],"ones.":[147],"intend":[149],"unveil":[151],"fingerprints.":[153],"Our":[154,203],"preliminary":[155],"work":[156],"automatically":[157],"identified":[158,205],"flexible":[159],"but":[161],"overlooked":[162],"low-rate":[163],"scanners.":[166],"In":[167],"this":[168],"work,":[169],"we":[170,183],"improved":[171],"identifier,":[174],"enabling":[175],"it":[176],"detect":[178],"stealth":[180],"scans.":[181],"Moreover,":[182],"revealed":[184],"scans\u2019":[186],"objectives":[187],"by":[188],"investigating":[189],"sets.":[192],"associated":[194],"with":[196],"threat":[197],"intelligence":[198],"verified":[200],"reliability.":[202],"approach":[204],"all":[206],"well-known":[207],"eight":[209],"unknown":[210],"on":[212],"one":[213],"month\u2019s":[214],"worth":[215],"data":[218],"collected":[219],"about":[221],"three-hundred":[222],"thousand":[223],"disclosed":[228],"Mozi":[233],"botnet":[234],"sets":[238],"were":[240],"previously":[241],"unreported.":[242]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":3}],"updated_date":"2026-05-06T08:25:59.206177","created_date":"2025-10-10T00:00:00"}