{"id":"https://openalex.org/W3034722371","doi":"https://doi.org/10.1109/noms47738.2020.9110444","title":"Discovering Collaboration: Unveiling Slow, Distributed Scanners based on Common Header Field Patterns","display_name":"Discovering Collaboration: Unveiling Slow, Distributed Scanners based on Common Header Field Patterns","publication_year":2020,"publication_date":"2020-04-01","ids":{"openalex":"https://openalex.org/W3034722371","doi":"https://doi.org/10.1109/noms47738.2020.9110444","mag":"3034722371"},"language":"en","primary_location":{"id":"doi:10.1109/noms47738.2020.9110444","is_oa":false,"landing_page_url":"https://doi.org/10.1109/noms47738.2020.9110444","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"NOMS 2020 - 2020 IEEE/IFIP Network Operations and Management Symposium","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5017422238","display_name":"Harm Griffioen","orcid":"https://orcid.org/0009-0006-7990-7802"},"institutions":[{"id":"https://openalex.org/I98358874","display_name":"Delft University of Technology","ror":"https://ror.org/02e2c7k09","country_code":"NL","type":"education","lineage":["https://openalex.org/I98358874"]}],"countries":["NL"],"is_corresponding":false,"raw_author_name":"Harm Griffioen","raw_affiliation_strings":["Cyber Threat Intelligence Lab, Delft University of Technology, Delft, the Netherlands"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Cyber Threat Intelligence Lab, Delft University of Technology, Delft, the Netherlands","institution_ids":["https://openalex.org/I98358874"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5000335949","display_name":"Christian Doerr","orcid":null},"institutions":[{"id":"https://openalex.org/I143288331","display_name":"Hasso Plattner Institute","ror":"https://ror.org/058rn5r42","country_code":"DE","type":"facility","lineage":["https://openalex.org/I143288331","https://openalex.org/I176453806"]}],"countries":["DE"],"is_corresponding":false,"raw_author_name":"Christian Doerr","raw_affiliation_strings":["Hasso Plattner Institute, Potsdam University, Potsdam, Germany"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Hasso Plattner Institute, Potsdam University, Potsdam, Germany","institution_ids":["https://openalex.org/I143288331"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":18,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"9"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9994000196456909,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/subnet","display_name":"Subnet","score":0.8612885475158691},{"id":"https://openalex.org/keywords/header","display_name":"Header","score":0.8509893417358398},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.82015061378479},{"id":"https://openalex.org/keywords/compromise","display_name":"Compromise","score":0.5989320278167725},{"id":"https://openalex.org/keywords/artifact","display_name":"Artifact (error)","score":0.5675448179244995},{"id":"https://openalex.org/keywords/field","display_name":"Field (mathematics)","score":0.5154827237129211},{"id":"https://openalex.org/keywords/network-packet","display_name":"Network packet","score":0.4940855801105499},{"id":"https://openalex.org/keywords/fingerprint","display_name":"Fingerprint (computing)","score":0.49175551533699036},{"id":"https://openalex.org/keywords/distributed-computing","display_name":"Distributed computing","score":0.46009132266044617},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4596414864063263},{"id":"https://openalex.org/keywords/throughput","display_name":"Throughput","score":0.4146861135959625},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.3451257348060608},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.3296022117137909},{"id":"https://openalex.org/keywords/computer-network","display_name":"Computer network","score":0.231255441904068},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.13022586703300476}],"concepts":[{"id":"https://openalex.org/C21099817","wikidata":"https://www.wikidata.org/wiki/Q7631721","display_name":"Subnet","level":2,"score":0.8612885475158691},{"id":"https://openalex.org/C48105269","wikidata":"https://www.wikidata.org/wiki/Q1141160","display_name":"Header","level":2,"score":0.8509893417358398},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.82015061378479},{"id":"https://openalex.org/C46355384","wikidata":"https://www.wikidata.org/wiki/Q726686","display_name":"Compromise","level":2,"score":0.5989320278167725},{"id":"https://openalex.org/C2779010991","wikidata":"https://www.wikidata.org/wiki/Q2720909","display_name":"Artifact (error)","level":2,"score":0.5675448179244995},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.5154827237129211},{"id":"https://openalex.org/C158379750","wikidata":"https://www.wikidata.org/wiki/Q214111","display_name":"Network packet","level":2,"score":0.4940855801105499},{"id":"https://openalex.org/C2777826928","wikidata":"https://www.wikidata.org/wiki/Q3745713","display_name":"Fingerprint (computing)","level":2,"score":0.49175551533699036},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.46009132266044617},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4596414864063263},{"id":"https://openalex.org/C157764524","wikidata":"https://www.wikidata.org/wiki/Q1383412","display_name":"Throughput","level":3,"score":0.4146861135959625},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.3451257348060608},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3296022117137909},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.231255441904068},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.13022586703300476},{"id":"https://openalex.org/C202444582","wikidata":"https://www.wikidata.org/wiki/Q837863","display_name":"Pure mathematics","level":1,"score":0.0},{"id":"https://openalex.org/C144024400","wikidata":"https://www.wikidata.org/wiki/Q21201","display_name":"Sociology","level":0,"score":0.0},{"id":"https://openalex.org/C555944384","wikidata":"https://www.wikidata.org/wiki/Q249","display_name":"Wireless","level":2,"score":0.0},{"id":"https://openalex.org/C36289849","wikidata":"https://www.wikidata.org/wiki/Q34749","display_name":"Social science","level":1,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/noms47738.2020.9110444","is_oa":false,"landing_page_url":"https://doi.org/10.1109/noms47738.2020.9110444","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"NOMS 2020 - 2020 IEEE/IFIP Network Operations and Management Symposium","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"display_name":"Partnerships for the goals","score":0.47999998927116394,"id":"https://metadata.un.org/sdg/17"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":20,"referenced_works":["https://openalex.org/W284347760","https://openalex.org/W2030087828","https://openalex.org/W2096030967","https://openalex.org/W2109599309","https://openalex.org/W2114398364","https://openalex.org/W2116227232","https://openalex.org/W2121654697","https://openalex.org/W2128346726","https://openalex.org/W2170924378","https://openalex.org/W2563821677","https://openalex.org/W2743785144","https://openalex.org/W2748868501","https://openalex.org/W2963666064","https://openalex.org/W2971604521","https://openalex.org/W4247909786","https://openalex.org/W6610362903","https://openalex.org/W6677217071","https://openalex.org/W6678359333","https://openalex.org/W6679308595","https://openalex.org/W6743493502"],"related_works":["https://openalex.org/W2801622120","https://openalex.org/W2102539527","https://openalex.org/W2164141394","https://openalex.org/W4240977217","https://openalex.org/W3036524962","https://openalex.org/W1967649051","https://openalex.org/W2508088450","https://openalex.org/W2389434635","https://openalex.org/W4214750239","https://openalex.org/W2279908259"],"abstract_inverted_index":{"To":[0,44],"compromise":[1],"a":[2,39,93,99,119,137,182,226],"computer,":[3],"it":[4,56],"is":[5,21,42,77,82,117,162],"first":[6],"necessary":[7],"to":[8,90,139,208,216,221],"discover":[9],"which":[10,15,109,151,189],"hosts":[11],"are":[12,152],"active":[13],"and":[14,34,88,141,173,187,210],"services":[16],"they":[17,96],"run.":[18],"This":[19],"reconnaissance":[20],"typically":[22],"accomplished":[23],"through":[24],"port":[25,159],"scanning.":[26],"Defense":[27],"systems":[28,124],"monitor":[29],"for":[30],"these":[31],"unsolicited":[32],"packets":[33],"raise":[35],"an":[36,153],"alarm":[37],"if":[38],"predefined":[40],"threshold":[41],"exceeded.":[43],"remain":[45],"undetected,":[46],"adversaries":[47,218],"can":[48,169,200],"either":[49],"slow":[50],"down":[51],"the":[52,64,66,73,104,156,176,196,219],"scan,":[53],"and/or":[54],"distribute":[55],"over":[57],"multiple":[58],"hosts.":[59],"With":[60],"each":[61],"source":[62],"below":[63],"threshold,":[65],"combination":[67],"of":[68,83,111,155,184,206,225],"all":[69],"may":[70],"still":[71],"complete":[72],"scan":[74],"efficiently.":[75],"It":[76],"especially":[78],"this":[79,133,167],"group":[80],"that":[81,166],"concern:":[84],"with":[85],"enough":[86],"resources":[87],"knowledge":[89],"execute":[91],"such":[92],"coordinated":[94],"activity,":[95],"will":[97],"pose":[98],"more":[100],"potent":[101],"threat":[102],"than":[103],"noisy":[105],"\"script":[106],"kiddie\".":[107],"Correlating":[108],"out":[110],"4":[112],"billion":[113],"IPs":[114],"potentially":[115],"collaborate":[116],"however":[118],"challenging":[120],"task,":[121],"hence":[122],"today\u2019s":[123],"do":[125],"not":[126,192],"consider":[127],"coordination":[128],"beyond":[129],"basic":[130],"subnet":[131],"aggregation.In":[132],"paper,":[134],"we":[135,179],"propose":[136],"method":[138,168],"identify":[140],"fingerprint":[142],"distributed":[143],"scanners":[144],"based":[145,174],"on":[146,175,181],"commonalities":[147],"in":[148,195,214],"header":[149],"fields,":[150],"artifact":[154],"way":[157],"fast":[158],"scanning":[160,212],"software":[161],"built.":[163],"We":[164],"demonstrate":[165],"effectively":[170],"locate":[171],"groups,":[172],"monitoring":[177],"logs":[178],"report":[180],"number":[183],"new":[185],"groups":[186],"tools,":[188],"have":[190],"previously":[191],"been":[193],"reported":[194],"academic":[197],"literature.Fingerprints":[198],"generated":[199],"ultimately":[201],"be":[202],"used":[203],"as":[204],"Indicators":[205],"Compromise":[207],"detect":[209],"mitigate":[211],"behavior":[213],"order":[215],"deny":[217],"possibility":[220],"learn":[222],"about":[223],"weaknesses":[224],"system.":[227]},"counts_by_year":[{"year":2025,"cited_by_count":2},{"year":2024,"cited_by_count":4},{"year":2023,"cited_by_count":3},{"year":2022,"cited_by_count":5},{"year":2021,"cited_by_count":4}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}